Hi,

If I am logged into my WS08 R2 PKI server and connect to my https://pki/certsrv server and try to "Download a CA certificate, certificate chain, or CRL"

I get this error message: An unexpected error has occurred: The Certification Authority Service has not been started.

Also if I try an 'Advanced Certificate Request" I see only 'User' and 'Basic EFS' templates.

 

However, if I am logged into any other machine on my network and then connect to https://pki/certsrv server, the "Download a CA certificate, certificate chain, or CRL" works correctly and the 'Advanced Certificate Request' page shows all the default certificate templates.

Any ideas?

 

The problem should be locally in the user session or the specific IE session on the PKI server as the web enrollment service is working properly from other machines.

Try switching off IE ESC Internet Explorer Enhanced Security settings on the PKI server as this might restrict access to active content. It is not recommended to switch off IE ESC, please read more about managing IE ESC http://technet.microsoft.com/en-us/library/dd883248(WS.10).aspx

/Hasain

 

• Marked as answer by Divine Wind Tuesday, August 23, 2011 11:40 AM

Hi S.Kwan,

 

Agree with Hasain that this problem should be caused by Internet Explorer Enhanced Security Configuration (IE ESC).

 

To solve this problem, please add the http://servername site to the Trusted sites.

 

1.    Run inetcpl.cpl to open IE Options.

2.    Switch to Security tab.

3.    Click Trusted sites. Click the Sites button. Add http://servername

 

Reopen IE and check the result.

 

Hope this helps.

 

Regards,

 

Bruce

Forum Support

Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

• Marked as answer by Divine Wind Tuesday, August 23, 2011 11:40 AM

Internet Explorer Enhanced Security Configuration was indeed the problem.Thank you!

Glad to hear the issue has been resolved. Thanks and have a nice day.

 

Regards,

Bruce

Disabled IE Sec in Windows 2012, now i am able to download Root Ca Certificate

Thanks