Questions[active-directory-adcs](server)

I built a constraint Enterprise CA limiting the application policy and EKU to Client and Server Authentication only.

Now I see that enrolling CAExchange failes (It requires Private Key Archival).

How can I stop enrolling this template?

What triggers the enrollment process?

We have two intermediate Enterprise CAs (Windows AD CS) in our AD domain. Both CAs only have the Certification Authority role enabled.

CA1 is responsible for issuing certificates to workstations and users and has a template Workstation Auth.

CA2 is responsible for issuing certificates to servers and has a template Server Auth.

Auto-Enrollment is enabled on all Workstations and servers in our domain and working.

Problem:

Workstations should only target CA1 for auto-enrollment
and servers should only target CA2 for auto-enrollment.

I want to achieve this using group policies.

I know that I can allow auto-enrollment on a template only for members of security groups, and that would work.

However, I prefer a solution using group policies, because we organise workstations and servers in different OUs. I can target both groups with group policies on OUs. The security group solution would require us to manage two new security groups on top of that.

Is it possible to configure a workstation or server to only auto-enroll from a particular Enterprise CA? I'm open to alternatives, if they can be achieved using group policies.

Suppose I have a CSR in which some Subject fields were not created according to X.509 - there are forbidden characters in Subject, or Country was provided as "England".

Is there any way to recover from that?

I tried:

• using policy.inf to resign the certificate, but I can't find any way to change existing Subject
• editing request directly on CA, but since there's some forbidden stuff in the CSR, the request immediately fails, and using certutil -setattributes results in "CERTSRV_E_BAD_REQUESTSUBJECT" (kind of expected, but a bit weird since you can try to reissue a request that's in "Failed" list).

I don't think that "fixing" bad CSR is possible here, but perhaps I'm wrong?

I got a request from a custumer to install ADCS using ECDSA while using a specific ECC curve for the keys (bp384r1). This curve is not listed in the ADCS installation process when creating a new key and choosing the CSP (Only the NIST ECDSA_P384 is there).

I am able to create a leaf certificate by specifing the key algorithm and CSP as 'ECDSA_brainpoolP384r1,Microsoft Software Key Storage Provider'. However this is not displayed in the ADCS installation GUI.

I also tried adding these lines to capolicy.inf before installing the CA but with no success...:
[NewRequest]
KeyAlgorithm=ECDSA_brainpoolP384r1
ProviderName="Microsoft Software Key Storage Provider"

Is there a way to limit the KSP key algortihm to a specific list, Or to change the default ECC curves choosen? Or tell ADCS to use the specific Key Algorithm I want?

Would appriciate any help with this - Thanks!

We installed the AD Certificate Services role on Windows 2016 Server version 1607. We cannot complete the post deployment configuration. We get the error "Value does not fall within expected range." After doing some digging, I found that it is conflicting with Windows Server Essentials Experience. I cannot remove the AD CS role. Every time I try and remove, I receive the error "The status of the role services on the target machine cannot be determined." I cannot figure out how to get this role removed.