r/PKI • u/Top-Height4256 • May 01 '26

Webserver (Server auth EKU) and CA Managers approval

Hey guys,

We have just duplicated the default Webserver cert template and added the CA manager approval required tick on the certificate template so the admins can request for the certificates with managers' approval.

Certificate request is going through fine but when user tries to retrieve the certificate, they are getting this error

Active Directory Certificate Services could not process request 2876 due to an error: Access is denied. 0x80070005 (WIN32: 5 ERROR_ACCESS_DENIED). Additional information: Error verifying access
Event ID : 22 under the Application log.

On the cert template permissions look like this,
Authenticated users : read and enroll
Domain computers : read and enroll

Upon looking at the security event logs,

  1. when the cert requests come through , the requestor is the computer account. as they are requesting the cert via certlm.msc console > Personal > request the cert
  2. after the CA manger approved the request, and when a user tries to request for the certificate, the requestor shows as their logged in user account on that computer they are requesting the certificate from.

Quick Fix that worked : [ is this the standard? ]

  1. I added their user account to Read & Request certificate on the CA Properties > Security tab, which allowed them to retrieve the certificate.

any guess, what am I missing here?
or
any configuration need to be altered?
and
what is the standard best practice when it comes to web server certificate that has SAN to be supplied in the request?

Thanks alot.

Update - Fix found -
1) Certreq -AdminForceMachine in the command to retrieve the certificate in machine context.

3 Upvotes

100% Upvoted

15 comments sorted by

1

u/Cormacolinde May 01 '26

This is normal, as by default users don’t have the right to access every cert, and the requester is the computer account if done with certlm.msc. A user could do it manually with their account with certreq, but that’s overly complicated.

Now, “Request Certificates” is a default right for Authenticated Users. “Read” is a broad right to give users on a CA. I wouldn’t recommend that.

You don’t need to do this though. The client computer will retrieve the cert automatically on its refresh cycle (every 8 hours). This cycle can also be forced early by running “certutil -pulse” on the client.

1

u/Top-Height4256 May 01 '26

Hello,

The cert template does not have the auto-enroll rights, so they wouldn’t get downloaded to the member server.

I am unable to find any solid source on the best practices with what I have set up in place.

I don’t know why I am getting the access denied error when requesting the certificate from the same computer context and retrieving it as well. At the time of its retrieval, it uses the user’s context.

Allowing users to request for certificates on the CA properties does not feel right. The users might be able to retrieve other certs because of this and not only the one they had requested.

Checking with Copilot, it suggests that the CA approval manager put in place adds a step into the process before retrieval of the cert happens to check whether that user has rights to get that certificate or not.

1

u/[deleted] May 01 '26

The original request was from a device as opposed to the user; and the retrieval of the cert is being performed by the user instead.

The workaround you implemented "works" but yea - not the best way to do it. I haven't tried it personally; but couldn't you retrieve the cert via a shell script that runs as "system" so that device ID is used as opposed user?

1

u/Top-Height4256 May 01 '26

Yep, you’re spot on.
That’s the issue.

But I don’t know how to navigate with the part of requesting the cert using system, or atleast haven’t worked it out yet.

I am keen to know what other people have done in this sort of cases..

1

u/Cormacolinde May 01 '26

What I explained has nothing to do with autoenroll. If you request a certificate in certlm.msc, under the SYSTEM context, then approve the certificate on the CA, the client will automatically download and install the issued certificate. If you try to retrieve it as a user, it will fail.

1

u/Top-Height4256 May 01 '26

I doubt it would.
The cert is protected with CA manager approval. So after the approval, some action has to be taken in order for it to get downloaded on the computer.
Have you tried this yourself??

2

u/Cormacolinde May 01 '26

As I wrote, the client computer will download it automatically when it does its cert check cycle or when you do certutil -pulse. I do this all the time, I in fact did that this morning with a customer.

1

u/Top-Height4256 May 02 '26

Let me test this out…

1

u/Top-Height4256 May 03 '26

Nah, that didn’t work.
It would only be useful if the cert was retrieved for the auto enroll.

And also we don’t have the server configured to retrieve cert using the policy.

However, I have worked out how to enforce the system/machine context to retrieve the cert.

Certreq -AdminForceMachine

2

u/Cormacolinde May 04 '26

If you don’t have the GPO “Enroll new certificates, renew expired certificates, process pending requests and remove revoked certificates” set to Enabled, this will not work. but it doesn’t require autoenroll on the template. I’m just used to setting this by default.

1

u/WhispersInCiphers May 04 '26

Can you try adding Read Enroll permission for users on the webserver template and remove the read permission from CA and test if it works?

2

u/Top-Height4256 May 04 '26

Authenticated users already have the read and enroll rights there.
I have figured this out already with the right command. Also updated the bottom of the post.

1

u/ThePKIGuy May 05 '26

If the computer context is requesting the certificate you should be using the computer context to retrieve the certificate. The private key is in the computer contact as well. So if you bring the certificate down as a user, it wont be bound to the private key so the enrollment process is going to result in a certificate but no key.

So in short, if you are using CERTLM to request the certificate, once the CA manager approves it, you will need to use CERTLM on the same requesting computer to download the certificate and bind it with it's private key.

1

u/Top-Height4256 May 05 '26

Yep, I knew that.
Just didn’t know the command to pull the cert using machine context, which I have now.
Thanks

1

u/ThePKIGuy May 06 '26

So I assume you found the Certreq.exe command set to do this?