Home / server / Questions / 1055568
Accepted
CryptoDan
Asked: 2021-03-02 12:38:14 +0800 CST

Autorenew not working when setting up key based renewal - Cep/CES

  • 772

I am trying to configure Key Based renewal using WES to support autorenwal of certificates in workgroup computers and untrusted domains.

I have configured CEP (Certificate Authenticatoin, Key Based Renewal) and CES (Certificate Authenticatoin, Key Based Renewal, Read Only Mode).

The client is a server joined to a non trusted domain. I succeed in setting up the CEP throgh GPO. And I am able to renew a certificate manualy throgh MMC.

However the certificate dosn't gets renewed automaticly. I do get eventid 1003 - that the certificate is about to expire. And autoenrolment is enabled throgh GPO. And if i try to manualy renewing - it works.

Any ideas?

certificate-authority ad-certificate-services active-directory-adcs

1 Answers

  1. Best Answer

    Based on your comments, the behavior you face is expected. Client doesn't have Autoenroll permissions on certificate template in foreign forest.

    Since you can enroll and renew certificates manually, you can go to CA server (or ask PKI admin to do this) and look for identity used to authenticate your request (Requester Name column). This user account must be granted Autoenroll permissions or add to a global or universal group that has appropriate permissions on that template. Then delete local policy cache and run certutil -pulse to trigger autoenrollment and attempt to renew the certificate.

    Note that if there is more fresh certificate based on same template, autoenrollment won't renew it until 80% of certificate lifetime is passed or template major revision is updated.

    • 1