I ran into an interesting problem at a client this week when I had to request a new certificate from their 2-tier, standalone Root CA and subordinate Enterprise CA, certificate authority infrastructure where a certificate template that we created by duplicating the Web Server template naming it Web Server Exportable then published would not show up in web enrollment request options. The following are screenshots of the behavior of the web enrollment page after removing all of the published certificate templates and leaving the one I want to use:
https://<subordinateCA>/certserv
No certificate templates could be found. You do not have permission to request a certificate from this CA, or an error occurred while accessing the Active Directory.
![clip_image002[4]](https://i0.wp.com/lh3.googleusercontent.com/-IFhm_SuvjFc/WBsrAMT_HrI/AAAAAAAB9po/pt4zpvulA2E/s1600-h/clip_image00242.jpg?ssl=1 "clip_image002[4]")
Note the (No templates found!) listed in the Certificate template: drop down box:
![clip_image002[6]](https://i0.wp.com/lh3.googleusercontent.com/-xzfhAYDInr4/WBsrC3nOTLI/AAAAAAAB9pw/msPpJD01aO0/s1600-h/clip_image00263.jpg?ssl=1 "clip_image002[6]")
![clip_image002[8]](https://i0.wp.com/lh3.googleusercontent.com/-UgpCti6jPUg/WBsrFlUeGAI/AAAAAAAB9p4/FjhNBgS4seo/s1600-h/clip_image00283.jpg?ssl=1 "clip_image002[8]")
After troubleshooting for a couple hours and attempting the following solutions found on the internet:
Verified the following KB was not the issue: https://support.microsoft.com/en-us/kb/811418
- Check to ensure the security permissions for the certificate template was set appropriately
- Ensure that Supply in the request was selected under the Subject Name tab
- Created a new application pool and assigned the Certsrv directory to it
- Ensure certificate template compatibility was the same or below the domain and forest functional level
- Changed the application pool’s advanced settings identity from ApplicationPoolIdentity to NetworkService
… which did not correct my issue, I went ahead and opened a case with Microsoft.
What we noticed was that we would be able to get the published template to show up if we changed the name from Web Server Exportable to Web_Server_Exportable, using a a different name. This lead the engineer to suspect that there might be something lingering in AD that was causing the template with the original name not to show up in the web enrollment webpage. To troubleshoot, we exported the Configuration container information to a text file via the ldifde command as such:
ldifde -f out.txt -d “CN=Configuration,DC=ad,DC=domain,DC=bm”
We then did a find on the exported out.txt file and immediately found an entry for WebServerExportable:
![clip_image002[10]](https://i0.wp.com/lh3.googleusercontent.com/-ZJSBeGj252E/WBsrH5QTTJI/AAAAAAAB9qA/M4mNoDq0tBg/s1600-h/clip_image002103.jpg?ssl=1 "clip_image002[10]")
What we found was that another certificate authority in Active Directory which was an Enterprise Root CA had a template published with the same name. Logging onto that server and launching the Certificate Authority administration console showed the following:
![clip_image002[12]](https://i0.wp.com/lh3.googleusercontent.com/-_LrVP-6ZAb4/WBsrKZj80oI/AAAAAAAB9qI/_nN6fqBfZ0k/s1600-h/clip_image002122.jpg?ssl=1 "clip_image002[12]")
The template listed as <Unknown> was what caused the template on the other CA to not be displayed so we went ahead and removed the template, forced an Active Directory replication with repadmin /syncall /AdePq, reran the ldifde export to confirm the template was no longer listed under this CA, then confirmed that the template is now shown in the web enrollment page.
Hope this post helps anyone who may come across a situation similar to this.
3 Responses
Terence, I have to give you props because this post put me on the right track to figuring out my web enrollemnt issue on my Windows 2016 CA. You rock! Specifically the 5 items to check were what I needed. My tips for anyone working through the No Templates… issue are:
1. In order for a certificate template to be available via web enrollement you MUST set the CA Compatibility Level on the Compatibility tab to Windows Server 2008R2 or earlier. Also, you CANNOT change an existing certificate template back to Windows Server 2008R2 if you picked a later O/S version.
2. You must use IE because Microsoft in their wisdom created the page with active scripting. You will know it doesn't work with another browser because you will see Loading… for the CSP and Hash Algorithm drop downs.
3. Before you try all the crazy suggestions on the internet or open a call with Microsoft, make your troubleshooting easier. Create a new template from the Web Server template. Set the CA Compatibility level to 2008R2. Set the Security to Authenticated users – Read,Enroll and Domain Computers – Read,Enroll. Publish the new template. Wait 2 mins for CertSrv to read the new template. Go to your CertSrv website and your new template should be listed.
Same issue for me under Windows Server 2019, creating a wildcard cert:
"No certificate templates could be found. You do not have permission to request a certificate from this CA, or an error occurred while accessing the Active Directory."
Verified the following KB was not the issue: https://support.microsoft.com/en-us/kb/811418
1. Duplicated the "Web Server" template to a different name (I prefer no spaces)
2. Subject Name "Supply in Request"
3. Request Handling "Allow private Key to be exported" OPTIONAL
4. Issuance Requirements "CA certificate manager approval" OPTIONAL
5. Set template security permissions appropriately
6. Added new template to the CA
7. Restarted ADCS OPTIONAL
Voila ! The new template was immediately available via Web Enrollment.
KB
Gay homosexual sex in bed