-
Title
Certificate Auto enrollment not working -
Description
Installed the Quest One Certificate Auto enrollment (qcert-1.0.0.649). But still not getting the certificate.
This is the error I am getting while trying to pulse Certificate Autoenrollment for the machine :
# /opt/quest/bin/qcert pulse
No certificate enrollment policy configured. Also I tried manually applying group policy.
#/opt/quest/bin/qcert pulse
policy module denied
-
Cause
Congfiguration issue -
Resolution
RESOLUTION 1:
1 - Install Active Directory Certificate Services on a Windows server or servers (version 2008 R2 or above)
Specifically the Certificate Enrollment Policy Web Service and Certificate Enrollment Web Service roles
2 - Choose to secure the enrollment web services with Kerberos
Quest One Certificate Autoenrollment only supports Kerberos3 - Ensure the certificate authority a domain member
The machine has to be a domain member if it is hosting the enrollment web services, because they have to be secured with Kerberos. If this is still not working please see the attached document for troubleshooting steps.
RESOLUTION 2:Subject line requirements for the certificate
1 - On the Subject Name Tab, select Build from Active Directory information and also ensure DNS name is checked
RESOLUTION 3:
Client was missing a reverse entry in DNS.
TROUBLESHOOTING COMMANDS:1. Make sure the client is joined and QAS is in a healthy state with the command: /opt/quest/bin/vastool status2. Debug commands to check the certificate: qcert -b -d5 pulse and qcert -b -d5 list3. Check permission on the template4. Restart IIS; iisreset5. Check DNS entries ensure it has both forward and reverse lookup exist.6. Check event viewer on the cert server for errors. -
Attachments