Online Certification Authority, cannot Select.

Question

I am trying to create a domain server and when I reach to specify the online certification Authority, the select button is grayed out.I wish to select the same computer as its the certification authority.Any help is appreciated.

Premium

Answer 1

My AD CS was running fine but my IIS server just wouldn't let me select it. To doublecheck that my Certificate Authority server is up I run certutil.exe from CMD and I could see my CA server up and running.

I fixed it in the most canon Windows troubleshooting way. IIS restart.

Gillies

Answer 2

Refer to this page: http://social.technet.microsoft.com/Forums/en-US/winserversecurity/thread/e3e43894-30d5-4064-93d1-96d46ef3de14/

The answer from that thread:

note that you can enroll certificates from IIS only from default V1 WebServer template. This template must be added to your issuing CA server.

Spandrel

I tried that option , it does not help. I had earlier created another domain certificate with the same CA. I was wondering if there is a limit to number of domain certificates we can create. – Premium

Can some one help me here? I am having the same issue here? However I am not sure what my domain CA is? I simply have one server with a domain name that points to it on the internet? – Translator

Answer 3

I had same problem and the answer "V1 WebServer template. This template must be added to your issuing CA server." did not resolve it. But, after I ran the following in command prompt:

certreq -submit -attrib “CertificateTemplate:WebServer” request.req

my request was processes and I was issued my certificate. In addition, I got Select button is worked fine.

Bathulda

Answer 4

Another way to resolve this problem, from here: https://www.experts-exchange.com/questions/27758425/Windows-2008R2-IIS-7-Domain-Certficate-problem-select-button-is-greyed-out.html

You could try enrolling the certificate through the certificates MMC snap-in instead and see if you have better luck:

Start -> Run -> type 'mmc' -> Press enter

(MMC console should open)

File -> Add/Remove Snap-in -> Select 'Certificates' -> Add -> Computer Account -> Local Computer -> Click OK out of the Add/Remove Snap-ins window.

Expand certificates -> Expand Personal -> Right click in an empty space in the main pane -> All tasks -> Request new certificate.

You should be able to run through that wizard and enroll based on your CA enrollment policies. Any certs that you enroll here and are applicable for securing websites will appear in IIS.

Bonham

Answer 5

A couple more checks for those facing this issue:

• Use a domain user and not a local user
• Check if your CA is an enterprise CA

Melitamelitopol