Home / server / Questions / 320565
In Process
Adam Robinson
Asked: 2011-10-12 11:39:59 +0800 CST

Certificate Template Missing from "Certificate Template to Issue"

  • 772

I'm having a problem similar to that posted in this question:

Missing Certificate template From certificate to issue

The short version is that I've created a duplicate certificate template and I'm trying to add it to my domain CA so that I can issue certificates with it. However, when I go into the Certification Authority MMC and go to "Certificate Templates -> New -> Certificate Template To Issue", my template is missing (along with quite a number of other templates that are present in the domain).

Unlike the previous question, however, my CA is running on Server 2008 R2 Enterprise. Our organization has a single DC and a single CA, so I'm not seeing where there could be propagation delay.

Any ideas how to get my template to show so that I can issue certificates?

windows-server-2008 certificate-authority ad-certificate-services

5 Answers

  1. Just wanted to throw this out there for future searchers who this doesnt apply to. For me, I had to go into ADSI Edit and change a flag from 2 to 10. I did have to restart ADCS service afterwards before the cert became available.

    "...ADSIEdit.msc, then expand CN=Configuration | CN=Services | CN=Public Key Services | CN=Enrollment Services. Right click the CA in the right pane that you want to enroll from and click properties. Find the flags attribute; and verify that it is set to 10. If it isn’t set to 10, then set it to 10 using ADSIedit.msc and allow for Active Directory replication to complete."

    http://securitymusings.com/article/1733/cant-create-a-new-certificate-template-to-issue

    • 4

  2. If you don't want to mess with adsiedit, you can use command certutil as workaround:

    • certutil -setCAtemplates +"templateName" (for adding template)
    • certutil -setCAtemplates -"templateName" (for removing template)

    Commands has to be run locally on Enterprise CA under Domain Admin and CA computer account has to have full control rights over such template.

    What is strange, is that parameter setCAtemplates isn't in official documentation nor builtin command help, but is working without problem. I found it in Windows Server 2008 - Active Directory Certificate Services Migration Guide

    • 2

  3. Does the account that is looking to use the template have the rights to do so? in the mgmt console, right click the Certificate template container and select manage templates. For the missing template, right click and select properties. On the security tab, ensure the account that wants to request the cert has the right to enroll.

    • 1

  4. I encountered the problem of certificate templates not appearing in user's computers in Certificate store, Windows 10. Here is a solution that worked for me.

    After you have created your certificate template, close Certificate Authority.

    Then launch certificate authority. Then view certificate templates. At this point, you will only see the certificate templates that are available for use. In my situation, since I was creating the first certificate template, nothing was appearing.

    To publish the certificate template that you are working on, from the context menu, highlight certificate templates. Select New | Certificate Template to issue. Then select the certificate template that you were working on.

    This will publish your certificate template to the world. It took me four hours to come up with this solution.

    Good luck.

    • 1

  5. If you are hunting for why the newly created template is not showing up for "Certificate Template To Issue", I ran into this on server 2012 R2. Just to try something, I stopped and restarted the Active Directory Certificate Services and then the newly created template showed up. If, for nothing else, it can't hurt to try it if you cant see your new template.

    • 0