Tell me about the issue and I’ll help you find the solution you need.
A Certificate Request That Uses a New Template Is Unsuccessful
Content provided by Microsoft
IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:
256986 Description of the Microsoft Windows Registry
When you try to enroll for a certificate against an enterprise certification authority (CA), you may receive one of the following error messages:
Certificate Request Denied
Your certificate request was denied.
Contact your administrator for further information.
Certificate Request Wizard:
The certification authority denied your request. Unspecified error.
This behavior may occur if the certificate enrollment request is using a recently-created certificate template. When a new template is added to the CA, the HKEY_CURRENT_USER cache is immediately updated but the HKEY_LOCAL_MACHINE cache is not immediately updated. The HKEY_LOCAL_ MACHINE cache is updated in the next 15 minutes if the CA or the domain controller are on the same computer, and in the next 10 minutes if the CA or the domain controller are in a distributed configuration.
WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.
To resolve this behavior, if you cannot wait for the applicable length of time, you can manually update the certificate template cache. The cache for computer certificates is in HKEY_LOCAL_MACHINE and the cache for user certificates is in HKEY_CURRENT_USER.
To force the cache update for a user certificate request, delete the following registry value from the client: