Blog Post

Core Infrastructure and Security Blog
4 MIN READ

Rescued by Procmon: The Case of the Certificate Authority Unable to Issue Certificates due to Revocation Failures

BrandonWilson's avatar
BrandonWilson
Icon for Microsoft rankMicrosoft
Sep 20, 2018
First published on TechNet on Apr 02, 2018 Hello Everyone, my name is Zoheb Shaikh and I'm a Premier Field Engineer with Microsoft India. I am back again with another blog and today I'll share...
Updated Sep 04, 2019
Version 3.0
ZohebShaikh
notyouraverageadmin's avatar
notyouraverageadmin
Brass Contributor
Dec 21, 2022

What a great success!  Any tips on using certutil/procmon to troubleshoot this error?  

 

System.Runtime.InteropServices.COMException (0x80094012): CertEnroll::CX509Enrollment::Enroll: You do not have permission to request this type of certificate.: The permissions on the certificate template do not allow the current user to enroll for this type of certificate. 0x80094012 (-2146877422 CERTSRV_E_TEMPLATE_DENIED)

We have verified permissions on the template are correct.  Interesting thing is this:  If we add the domain group 'Everyone' with read and enroll permissions, the error message goes away and autoenrollment is successful.  We aren't seeing anything in the event logs to correlate with this AD FS error.