A Certificate Request That Uses a New Template Is Unsuccessful

Article ID: 281260 - View products that this article applies to.
This article was previously published under Q281260
IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:
256986
(http://support.microsoft.com/kb/256986/EN-US/ )
Description of the Microsoft Windows Registry
Expand all | Collapse all

SYMPTOMS

When you try to enroll for a certificate against an enterprise certification authority (CA), you may receive one of the following error messages:

Web enrollment:
Certificate Request Denied

Your certificate request was denied.

Contact your administrator for further information.

Certificate Request Wizard:
The certification authority denied your request. Unspecified error.
Back to the top | Give Feedback

CAUSE

This behavior may occur if the certificate enrollment request is using a recently-created certificate template. When a new template is added to the CA, the
HKEY_CURRENT_USER
cache is immediately updated but the
HKEY_LOCAL_MACHINE
cache is not immediately updated. The
HKEY_LOCAL_ MACHINE
cache is updated in the next 15 minutes if the CA or the domain controller are on the same computer, and in the next 10 minutes if the CA or the domain controller are in a distributed configuration.
Back to the top | Give Feedback

RESOLUTION

WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

To resolve this behavior, if you cannot wait for the applicable length of time, you can manually update the certificate template cache. The cache for computer certificates is in
HKEY_LOCAL_MACHINE
and the cache for user certificates is in
HKEY_CURRENT_USER
.
  • To force the cache update for a user certificate request, delete the following registry value from the client:
    HKEY_CURRENT_USER\Software\Microsoft\Cryptography\CertificateTemplateCache\Timestamp
To force the cache update for a computer certificate request:
  1. Delete the following registry value from the client:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\CertificateTemplateCache\Timestamp
  2. Delete the following registry value from the CA:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\CertificateTemplateCache\Timestamp
  3. Restart the Certificate Services on the CA.
Back to the top | Give Feedback

MORE INFORMATION

In addition to the preceding error message, the CA logs the following event message in the program log:

Event Type: Warning
Event Source: CertSvc
Event Category: None
Event ID: 53
Date: 08/14/2000
Time: 05:13:00
User: N/A
Computer: computername
Description:
Certificate Services denied request 4 because the requested certificate template is not supported by this CA. 0x80094800 (-2146875392). The request was for domain\user. Additional information: Denied by Policy Module

Back to the top | Give Feedback

Properties

Article ID: 281260 - Last Review: December 3, 2007 - Revision: 7.5
APPLIES TO
  • Microsoft Windows Server 2003, Standard Edition (32-bit x86)
  • Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
  • Microsoft Windows Small Business Server 2003 Premium Edition
  • Microsoft Windows Small Business Server 2003 Standard Edition
Keywords: 
kberrmsg kbprb KB281260
Back to the top | Give Feedback

Give Feedback

 
Back to the topBack to the top