Request Certificate

Hi
Is´t possibly to request a computer and root certificate from a public Microsoft Windows Server 2008 R2 CA with a script?
Best regards Andreas

Hi,
As this thread has been quiet for a while, we will mark it as ‘Answered’ as the information provided should be helpful. If you need further help, please feel free to reply this post directly so we will be notified to follow it up. You can also choose to unmark
the answer as you wish.
BTW, we’d love to hear your feedback about the solution. By sharing your experience you can help other community members facing similar problems. Thanks for your understanding and efforts.
Best Regards
Kevin
TechNet Subscriber Support
If you are
TechNet Subscription user and have any feedback
on our support quality, please send your feedback here.

Similar Messages

Non-domain computer request certificate

We have Enterprise CA with Certificate Enrollment Policy Web Service and Certificate Enrollment Web Service on same domain computer.
When I configure Enrollment policy on non-domain computers by adding exist Certificate Enrollment Policy Server:
mmc->Certificates(local computer)->Personal-Manage Enrollment Policy, all looks fine. But when I do request
New Certificate -> Select Certificate Enrollment Policy appears window with empty list and message:
Certificate types are not available.You cannot request a certificate at this time because no certificate types are available. From domain computers all works fine, I can choose templates from the list and can do command:
certutil -config "DomainComp\CAname" -ping.
from non-domain computers I can't do certutil -ping:
...Connecting to DomainComp\CAname ...
Server could not be reached: The RPC server is unavailable. 0x800706ba

I'm used select username/password authentication when installed CES/CEP roles. If I want to use authentication with
certificates, I must to make request and enroll it on CA. This is a problem for non-domain computer. By the way, using method:
http://social.technet.microsoft.com/Forums/windowsserver/en-US/098f858a-3e89-48d2-828e-274487033f6b/how-to-request-certificate-from-a-nondomain-computer?forum=winserversecurity
I can manually make request file, issue it on Enterprise CA and export certificate file, when import certificate.
This method
http://blogs.technet.com/b/askds/archive/2010/05/25/enabling-cep-and-ces-for-enrolling-non-domain-joined-computers-for-certificates.aspx not work because appears empty list of enrolment templates.

How to request certificate from a non-domain computer

We using a Windows Server 2008 R2 Enterprise CA to issuing webserver-certificates (SSL). The CA-Server is a member of a AD-Domain and online. Now we want to request certificates from computers like Windows Server 2008 R2 or Linux Server which aren't member
of the domain.
How we can request certificates automatically with a script remote from these Windows Servers, for example ? Is it possible to use the "Certificate Enrollment Web Service" without the "Certificate Enrollment Policy Web Service" ?
Is it possible to use certreq in this scenario ?
Thanks for your help.

Now I have found a solution. Shortly I want describe the way:
Prerequirements:
1. ADCS Enterprise Certification Authority is installed
2. ADCS Certificate Enrollment Web Service is installed on a server
3. ADCS Certificate Enrollment Policy Web Service is installed on an other server
Steps to do:
1. Prepare a request-file for a certificate
2. On a computer which is not a member of the Domain/Forest of the CA-Service: submit the request to the CA and receive the issued certificate. The following command have to written in one line without line breaks.
certreq -submit
    -Username {domain}\{username}
    -p {password}
    -PolicyServer "https://{FQDN CertificateEnrollmentPolicyWebService-Server/-Alias}/ADPolicyProvider_CEP_UsernamePassword/service.svc/CEP"
    -config "https://{FQDN CertificateEnrollentWebService-Server/-Alias}/{CAName}_CES_UsernamePassword/service.svc/CES"
    -attrib "CertificateTemplate:{TemplateName}"
    {Enter Path and Name of the Request-File}
    {Choose Path and Filename for certificate}
   Sample:
   certreq -submit
        -Username contoso\Serviceaccount
        -p P@ssw0rd
        -PolicyServer "https://CAPolicyEnroll.contoso.com/ADPolicyProvider_CEP_UsernamePassword/service.svc/CEP"
        -config "https://CAWebEnroll.contoso.com/IssuingCA1_CES_UsernamePassword/service.svc/CES"
        -attrib "CertificateTemplate:MyOwnSSLTemplate"
        request.req
        sslcert.cer
3. Now you can find a file with your requested certificate locally in path you have choosen for the certificate-file.
I hope this will be helpful for other people enrolling certificates on non-domain member computers.

Request Certificate error

Hi,
I have generated Request Certificate thruogh sapgenpse after that when importingthat certificate from service market place getting error like
The submitted Distiguished Name (DN) does not match the DN contained in the request for the SAProuter certificate.
Click on Go back.
Please give the solution.
Thanks,
venkat

Hello,
>Please give the solution.
Please, show that you have investigated on this problem.
Help yourself first and then, people will maybe find some time to help you....
Regards,
Olivier

Exchange 2013 request certificate remain pending after complete

Hi Folks
I have installed a standalone CA Windows 2008r2 on server joined to AD. Also I have installed Exchange 2013 SP1.
After Exchange request certificate, I have submitted request to my standalone CA. Downloaded certificate on Exchange 2013 and then I have imported it (I have done complete from Exchange 2013 console) but certificate remain pending.
I have seen using get-exchangecertificate, thumbprint are different. I mean from Exchange command I receive a thumbprint, but if i see thumbprint from certificate imported the two thumbprint are different.
Any ideas?
Many thanks
Maximilian

There is a separate section for pending requests.
if you look further down, there is a separate bit - including an example here::
Cheers,
Rhoderick
Microsoft Senior Exchange PFE
Blog:
http://blogs.technet.com/rmilne
Twitter:   LinkedIn:
  Facebook:
  XING:
Note: Posts are provided “AS IS” without warranty of any kind, either expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.

Problem in requesting certificate from enterprice CA

I have an enterprice CA and I created a new certificate template for SCOM authentication, and when I submit a certificate from web enrollment I got this error massege:
Certificate Request Denied
Your certificate request was denied.
Your Request Id is 63. The disposition message is "Denied by Policy Module 0x80094800, The request was for a certificate template that is not supported by the Active Directory Certificate Services policy: SCOM Template.
Contact your administrator for further information.
I checked the authentication and make it: everyone full control. when I request a certificate from the same CA with another template it works well without any errors !!
please feed me back with any suggestions
Hossam Wael Elmosallamy IT Support Engineer ECC Solutions MCSE - CCNA [email protected] Mobile: +2(014)-9464671 Work: +202-3828-4576 www.eccsolutions.net "Experience Reliability"

At the end of the day your CA adminstrator has to allow you to make a request via that template and have it auto-approved. By default, you cannot just define a new template, import it into CA server and expect it to bypass explicit policy. Depending
on whether your CA is domain joined or not, you may also be dealing with global corporate policy (and defaults) that prevent someone from hacking a new CA server into the companys network, adding a new template and executing it with a request for automatic
approval.
These are the keys to the kingdom you are messing with ... you have to go to the king.
Microsoft Corporation

Requesting certificate from certificate authority

I am in the last step of migrating from a personal account to a business account. I need to remove my old certificate, request a new one from the Certificate Authority in my keychain access. I attempt to get the new certificate, but it says the Certificate Authority email address is required. Does anybody know it or know how to bypass this step? Thanks

I am actually working on getting this setup for user Certs. and I am having some trouble. Can you tell me how you got this working?

Use gpo to determine computername, request certificate and import certificate to computer powershell

Hey everyone,
For deployment of winrm i need to deploy certificates in our environment.
Now every certificate has to have a different name (computername)
Is there a way to automate this?
I would like to create a script that checks the computername, requests and imports the personalised certificate.
Kind regards,
Borrie

Jrv,
I don't think that's correct, as you can see in the link underneath for each computer or server you need to create a certificate and import in:
http://blogs.technet.com/b/meamcs/archive/2012/02/25/how-to-force-winrm-to-listen-interfaces-over-https.aspx
That's why i would like to create a script to automate this task.
The script should check the computername, check if the cert already exists, if not request and import it with the computername as parameter.
Borrie
* edit, the procedure in the link describes using the domain name in stead of computername but I really need the computername, after importing the cert i also need it's thumbnail for use with configuring winrm and soon also another application.

Requesting certificate problem ( SRV 2008 R2 )

Dears,
I have problem with requesting the certificate on server 2008 R2 , I create some template and I enable supply on the request but I couldn't enter the credential and customize the cert information like we had on 2003 . and when I put the root hash
on the saved request but the "Error Parsing Request ASN1 bad tag value met. 0x8009310b (ASN: 267)" happens .

Amir, I think you are trying to request an SSL certificate but you need to be able to export the private key after you receive the certificate correct? If that is the case, the template needs to allow for the private key to be exportable. But I am confused,
because you say you create the request in IIS (management tool?) but then you say you are using the Basic EFS template - those dont seem to make sense to me. Did you mean to use the Web Server template? If so, that template does not allow the private key to
be exportable. So you could duplicate the template (right click, duplicate) and make it a V2 template (Windows 2003 type - do not use V3/2008 as it wont be available on the web enrollment page).
It would be a lot easier if you could tell us what kind of certificate you need and where you need it (what operating system, etc..)
Mark B. Cooper, President and Founder of PKI Solutions Inc., former Microsoft Senior Engineer and subject matter expert for Microsoft Active Directory Certificate Services (ADCS). Known as “The PKI Guy” at Microsoft for 10 years.

Geneating a request certificate doesnt work

Normally it's a process that has no problem but in this server when I tried to generate a certificate request through the Certificate Setup Wizard, it says that the Administration Server is down.
The administration server port is running and responding and I don't have problems with Console, neithe accesing the other servers through the Console.
The attempt to generate the certificate is logging at admin-serv/logs/access
What change could affect the Setup Wizard?
Can I do this process through the command line interface?
Thanks in advance for your help, I don't have any idea where I have to review or correct something.

Hello,
I've has the same problems, and can't resolve it. However the
request was send per email, and the installation of the returned
cert makes no problems.
Best regards
Lars

Lync 2013 edge server request certificates

I am deploying Lync 2013 edge server, how to get the certificate request file[certificate
signing request (CSR)] on setp 3: Reques,install or Assign Certficates.
i need your help!
Thanks!

Agree with Jason.
On the Certificate Request File page, type the full path and file name to which the request is to be saved.
After you get Certificate Request File, you need to submit this file to your CA (by email or other method supported by your organization for your enterprise CA) and, when you receive the response file, copy the new certificate to this computer so that it
is available for import.
Check how to set up certificates for the internal edge interface at
http://technet.microsoft.com/en-us/library/gg412750.aspx.
Check how to set up certificates for the external edge interface
http://technet.microsoft.com/en-us/library/gg398409.aspx.
Lisa Zheng
TechNet Community Support

Request certificate for Linux client - web enrollment

"Internet Explorer cannot run in the local computer's security context; therefore, users can no longer request computer certificates by using Web enrollment."
https://technet.microsoft.com/en-us/library/cc732517(WS.10).aspx
Does this mean that we cannot submit a request for a web server certificate via the web interface on behalf of a Linux based web server?
If so, what recourse do we have? Must we use the command line?
http://blogs.technet.com/b/pki/archive/2009/08/05/how-to-create-a-web-server-ssl-certificate-manually.aspx
Of course, Group Policy and auto-enroll is not an option either.
Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you.

Web Enrollment no longer support direct certificate enrollment to local machine or smart card store. You have to generate certificate request outside of web enrollment. Though, you can submit pregenerated request via web enrollment pages.
Vadims Podāns, aka PowerShell CryptoGuy
My weblog: en-us.sysadmins.lv
PowerShell PKI Module: pspki.codeplex.com
PowerShell Cmdlet Help Editor pscmdlethelpeditor.codeplex.com
Check out new: SSL Certificate Verifier
Check out new:
PowerShell File Checksum Integrity Verifier tool.

COM error while submitting certificate request

Hello there
I have created a group and assigned Read, Issue and Manage Certtificate, Manage CA & Request Certificate permission on the CA.When any member of this group try to sign a certificate request,
the following error accours.
Your request failed. An error occurred while the server was processing your request.
Contact your administrator for further assistance.
" type=button
Request Mode: newreq - New Request
Dis"font-size:9pt;">(never set)
Disposition message: (none)
Result: The RPC server is unavailable. 0x800706ba (WIN32: 1722)
COM Error Info: CCertRequest::Submit: The RPC server is unavailable. 0x800706ba (WIN32: 1722)
LastStatus: The operation completed successfully. 0x0 (WIN32: 0)
Suggested Cause: This error can occur if the Certification Authority Service has not been started.
During this time event ID 10016 is logged on the eventlog
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
{D99E6E73-FC88-11D0-B498-00A0C90312F3}
and APPID
{D99E6E74-FC88-11D0-B498-00A0C90312F3}
to the user <Domain>\<Username> SID (<SID>) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
I have assigned the required permissions to the group on
CertSrv Request. Also verified the membership of
Certificate Service DCOM Access.
Can you please help me to resolve this?
Thanks
Ranjith

Hi Ranjith,
I suggest you restart the certificate services and try to enroll certificates to test if the Certification Authority is functioning.
In addition, please make sure that ports in the blogs below are open:
Firewall Rules for Active Directory Certificate Services
http://blogs.technet.com/b/pki/archive/2010/06/25/firewall-roles-for-active-directory-certificate-services.aspx
Best Regards,
Amy
Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

Request Smartcard Logon certificates for more than 2 years from Certificate Authority

Dear all,
I have setup a Certificate Services in a Windows Server 2008 R2 domain and I request certificates via the CA webpage
http://ipofdomainserver/certsrv using the SmartCard logon custom template.
The problem is that my certificates are only valid for 2 years even though when I created my custom Smartcard logon I selected for validity period 5 years.
I read in documentation that issued certificates cannot have a greater validity than the root that signed them.
What and where I should modify to be able to request certificates from the template for more years than standard 2 ?
Ps: WINSC-CA is valid for 5 years. Should I generate a new WINSC-CA ? How ?

I was successfully able to create a root CA for 20 years, issued a certificate and login using smartcard using the following procedure:
1. I increased the CA lifetime to 20 years by using this link http://www.expta.com/2010/08/how-to-create-certificates-with-longer.html
Created the file CAPolicy.inf in %SYSTEMROOT% with following content
[Version]
Signature=”$Windows NT$”
[certsrv_server]
RenewalValidityPeriod=Years
RenewalValidityPeriodUnits=20
2. Renew CA root using this guide https://technet.microsoft.com/en-us/library/cc780374(v=ws.10).aspx
Console Root -> Certification Authority -> select domain -> Right click -> All Tasks ->
Renew CA certificate
3. Delete from Console Root -> Certificates (local computer) -> Trusted Root Certification
Authority -> Certificates the *WINSC-CA that has the previous lower validity, and from
Certificates (local computer) -> Personal, the *WINSC-CA that was lower validity
4. I performed a reboot here
5. Change in Console Root -> Certificate Templates -> Smartcard Logon Custom Template (my custom duplicate template) -> Properties -> Validity 10 years
6. Change in registry HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\CertSvc\Configuration\<CAName>\ValidityPeriod
to value 10 for 10 years.
7. Request a new certificate from CA webpage http://ipofdomain/certsrv and let the webpage write it to
smartcard (I was making sure there is no other certificate on the smartcard)
8. Try to log in. At this point it should throw an erorr that smartcard logon is not supported for this
account type. This is becuase we need to enroll it again for domain authentication
9. Console Root -> Certificates (local Computer) -> Personal -> Right click -> All Tasks ->
Request new Certificate -> Next -> Active Directory Enrollment -> Next -> Select Domain Controller Authentication -> Enroll -> Finish.
Now you should be able to login using your smartcard and 10 years generated certificate.
Though I have a problem at step 3, after CA server reboots the *WINSC-CA certificate with lower
validity is restored automatically, but the certificates are generated for 10 years.
What am I doing wrong ? How can I delete the lower validity root CA ?

How the status of certificate can change from Requested

I have create new wallet.
The certificate has status Requested.
How can i change it to ready?
What is the role of Certification Authority?
Any one who have worked on ssl.
Waiting for reply.
Thanks to all.

You have to export the requested certificate and have it signed by a Certifcate Authority. This can be the Oracle CA (part of 10g AS).
Then use the signed certificate and import it.
Afterwards you'll need to reconfigure the httpd.conf to use the wallet with the signed certificate.
cu
Andreas

Request Certificate

Similar Messages

Maybe you are looking for