Chicago Area Laptop for rent: $35 per day plus $10 for additional day

Certificate Services Troubleshooting

Certification authority (CA) Web enrollment pages that are installed on a remote server other than the CA do not work.

Cause: The pages are set to use NTLM authentication instead of basic authentication.

Solution: If the Web pages are located on a different server than the CA, then you must set the pages to use basic authentication rather than NTLM if the CA is an enterprise CA. You should also use Secure Sockets Layers (SSL) to secure these pages to protect the passwords. See the Internet Information Services (IIS) documentation to change these settings.

Error when accessing the certification authority Web pages.

Cause: Web pages aren't installed on the certification authority (CA).

Solution: From the command prompt on the CA, run certutil -vroot to install the Web enrollment pages.

Cause: Web pages don't have execute script permissions.

Solution: From Internet Information Services (IIS), open the CertSrv folder and confirm that there are execute script permissions on the folder. The CertSrv folder is:

Systemroot/System32/Certsrv

Web pages on an enterprise certification authority (CA) either don't generate certificates or generate certificates that are not valid.

Cause: For an enterprise CA, Web pages require that the user be authenticated. If the pages are set to allow anonymous connections, then the CA will either not generate certificates or will generate certificates that are not valid.

Solution: See Set security for access to certification authority Web pages

Certificate Services Troubleshooting Tools

certutil