SSL Certificate Error 0x80094800

[NewNetworkAdmin]

Hi,

I have already posted this thread in the Windows Server 2003 forum (thread931-1325019) but no-one there seems to be able to help, so I thought I'd try asking it here too (as I guess this is where it should have been posted in the first place!!)

I am trying to set up an SSL certificate that will allow users to connect to our Intranet and Outlook Web Acess sites securely (using HTTPS). I followed the instructions at

http://www.msexchange.org/tutorials/Securing-Exchange-Server-2003-Outlook-Web-Access-Chapter5.html

under the section Enabling SSL on OWA.

I installed the Microsoft Certificate Service and set it up as an Enterprise Root CA. I then created a new certificate using the Certificate Wizard within IIS using the certification authority of servername.domain.com\servername that appeared in the drop-down list for Certification Authorities. This seemed to go ok and I enabled SSL on the default web site in IIS. Sure enough, when I tried to connect using HTTP I got an error that said the connection had to be secure. I tried HTTPS and it said "Page cannot be found".

I created a new MMC console for the Certification Authority and looking at the "Failed Requests" section. It has about 30 failed requests listed (I've probably tried about 30 times now!). The errors read like this:

Denied by Policy Module 0x80094800, The request was for a certificate template that is not supported by the Certificate Services policy: WebServer.

I also tried to submit the certificate request using the IIS web page

http://servername/certsrv

but I got a similar error message:

Your certificate request was denied. 

Your Request Id is 32. The disposition message is "Denied by Policy Module 0x80094800, The request was for a certificate template that is not supported by the Certificate Services policy: WebServer. ". 

Contact your administrator for further information.

I guess that there is something I have not configured properly in the Windows Server 2003 CA configuration but I have no idea what it is. I have searched the Internet for help but cannot find the solution anywhere. If anyone has any ideas where I can find it or what to search for then please point me in the right direction.

Any help greatly received. Thanks in advance.

Andy

 

[Serbtastic]

Try following the instructions on this page:

http://www.msexchange.org/tutorials/SSL_Enabling_OWA_2003.html

 

[NewNetworkAdmin]

Serbtastic,

Thanks for the quick response. I tried following the instructions on the link you gave me and I got the following error when I attempted to submit the Certificate Request:

Your certificate request was denied. 

Your Request Id is 107. The disposition message is "Denied by Policy Module 0x80094800, The request was for a certificate template that is not supported by the Certificate Services policy: WebServer. ". 

Contact your administrator for further information.

Any suggestions?

Andy

 

[NewNetworkAdmin]

I've just thought of some info that I didn't include that might be useful...

The 2 domain controllers in our domain are Windows 2000 and the server that is trying to create the certificate is a member server running Windows server 2003.

Not sure is that helps anyone but thought it might.

Andy

 

[NewNetworkAdmin]

Hi,

My last post was prompted by the info I found here: [URL unfurl="true"]http://www.pcreview.co.uk/forums/thread-1596312.php[/url]. Someone was having the same problem and this was there resolution:

It appears as though the Windows 2000 templates could not be enumerated on
the Windows 2003 Certsrv. A suggestion was to extent our 2000 AD schema to
2003's. We didn't want to do that considering we are still in the middle of
migration with 40+ Domain controllers. The windows 2003 Enterprise CA is
removed and two Windows 2000 CAs are implemented instead. Everything is
smooth now. We'll look at implementing the Windows 2003 enterprise CAs in a
2003 forest when we cross that bridge. I always hate it when my lab works
fine .

I therefore tried removing the CA services from the Windows 2003 OWA server and instead installed them on our Windows 2000 Advanced Server that is a domain controller. I created the certificate request on the Win2k3 server and got the Win2K box to create the certificate and then applied the certificate on the win2k3 server. It all works now! I'm not sure what the guy from the other forum meant by "A suggestion was to extent our 2000 AD schema to 2003's". Does anyone understand this? And if so, is there something I can do that might have made the certificate creation work on the Win2k3 server?

Thanks for all your help anyway.

Andy