I have a DC,DNS, and CA on a Windows Server 08 ST machine to start off with. My goal is to use this to have certificates generated for routers all across my network so that my IT dept no longer receives the invaild certificate error message. The routers are a mix of FortiGate 200b,60c, and 60bs. When I generate the request on the router, it exports it into a .csr file format. Windows server 08 does not recognize it as such, and I try to convert it to an accepted format and every time I do I get an error message back from the CA saying Denied by policy Module 0x80094801. I'm not sure where I am going wrong. I would appreciate any and all advice to try. Thanks

Check if the below link helps: http://support.microsoft.com/kb/910249

Hi, This issue may occur when the certificate template information is missing from the request file Please try to use the command "certreq -submit -attrib CertificateTemplate:<templatename>" to specify a template Hope this helps! Best Regards Elytis Cheng Elytis Cheng TechNet Community Support

Hi, This issue may occur when the certificate template information is missing from the request file Please try to use the command "certreq -submit -attrib CertificateTemplate:<templatename>" to specify a template Hope this helps! Best Regards Elytis Cheng Elytis Cheng TechNet Community Support

If you are using a Standalone CA to get the certificates then you will still recieve the failure even after using the command "certreq -submit -attrib CertificateTemplate:<templatename>" for Enterprise CA the above command will resolve the issue. If you are using Standalone CA then the best way to request the certificate is either to use Web Enrollment pages or by creating .inf files that contains certificate information and then using the certreq.exe to submit and generate the certificate. You can find more details about certreq.exe in http://technet.microsoft.com/en-us/library/cc725793(v=ws.10).aspx

If you are using a Standalone CA to get the certificates then you will still recieve the failure even after using the command "certreq -submit -attrib CertificateTemplate:<templatename>" for Enterprise CA the above command will resolve the issue. If you are using Standalone CA then the best way to request the certificate is either to use Web Enrollment pages or by creating .inf files that contains certificate information and then using the certreq.exe to submit and generate the certificate. You can find more details about certreq.exe in http://technet.microsoft.com/en-us/library/cc725793(v=ws.10).aspx