"No certificate templates could be found. You do not have permissions to request a certificate from this CA..

Question

or an error occurred while accessing Active Directory."
When I set up the subordinate CA where I am seeing this error message (when attempting to make a request via the web interface for a Linux client - Group Policy not possible here) I opted to not "Load Default Templates".
Just FYI, PKI View shows "OK" for everything.
Permissions on the template are Read and Enroll for Authenticated Users.
Issuance Requirements are "CA certificate manager approval" (checked) - nothing else checked. "Same criteria for enrollment".
Have I googled?
That's just the problem. I've seen plenty of hits where people say "I've solved it this way and I've solved it that way".
What is the (MS) recommended method to solve this problem?
I'm concerned some solutions might be the equivalent of disabling CRL checks to resolve CRL problems - something where the solution is worse than the problem.
Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you.

Answer 1

OK. This is the problem. When I duplicated the web server template, I had the choice of Windows Server 2003 or 2008 (Enterprise).
I selected 2008 (OK, in the screenshot 2003 is selected - by default).
Windows 2008 based templates (v3) do not work with web enrollment.
https://technet.microsoft.com/en-us/library/cc732517(WS.10).aspx
Absolutely none of the other solutions will help if you make this choice:
- no adjustments of IE settings will help (if you thought it was "something" with your browser.
- It does not matter if the Windows Authentication provider is set to NTLM or Negotiate first.
- Application Pool identity can be ApplicationPoolIdentity or Network service.
- You can enable or disable Anonymous Authentication.
If you decide to select a v3 template, forget about using web enrollment.
You will spend hours t-shooting.
It will not work.
IMPORTANT EDIT
Having tried this on a second CA, it seems that you might have to change the NTLM and App Pool settings.
I simply duplicated a template (2003) and thought I was all set.
Not at all.
I had to play with the Provider priority (put NTLM above negotiate) and use "Network Service" for the Default App Pool identity.
Then it finally worked.
Yes, an iisreset /noforce after each change.
I'm not sure why this is so complicated.
Maybe someone from Microsoft could explain what is going on here.
This is documented nowhere. You have to proceed by trial and error until you get the right combination.
Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you.