Microsoft CA Auto Enrollment

🔒 Secure Bits 💡
Weird 𝗶𝘀𝘀𝘂𝗲𝘀 𝘄𝗶𝘁𝗵 𝗔𝘂𝘁𝗼 𝗘𝗻𝗿𝗼𝗹𝗹𝗺𝗲𝗻𝘁 in Microsoft CA? Here’s one that cost me hours.

I recently set up a 𝗳𝗿𝗲𝘀𝗵 𝗜𝘀𝘀𝘂𝗶𝗻𝗴 𝗖𝗔 on Windows Server 2025 in a brand-new Active Directory domain:
✔️ Auto-enroll GPO? ✅
✔️ Certificate template published & configured for domain computers? ✅
✔️ ACLs set up? ✅

𝗬𝗲𝘁 — 𝗻𝗼 𝗰𝗲𝗿𝘁𝗶𝗳𝗶𝗰𝗮𝘁𝗲. Not after a reboot. Not after waiting. Nothing.

After 𝗵𝗼𝘂𝗿𝘀 𝗼𝗳 𝘁𝗿𝗼𝘂𝗯𝗹𝗲𝘀𝗵𝗼𝗼𝘁𝗶𝗻𝗴, I stumbled upon Uwe Gradenegger’s great blog:
🔗 https://www.gradenegger.eu/en/the-request-for-a-certificate-fails-with-the-error-message-the-requested-certificate-template-is-not-supported-by-this-ca/

𝗛𝗲𝗿𝗲’𝘀 𝘄𝗵𝗮𝘁 𝘄𝗮𝘀 𝘄𝗿𝗼𝗻𝗴 ⬇️
💥 The ACL about who can actually request certificates 𝗼𝗻 𝗖𝗔 𝗹𝗲𝘃𝗲𝗹 was not synced.

𝗥𝗲𝗾𝘂𝗲𝘀𝘁 𝗖𝗲𝗿𝘁𝗶𝗳𝗶𝗰𝗮𝘁𝗲𝘀 𝗔𝗖𝗘 (𝗘𝗻𝗿𝗼𝗹𝗹) 𝘀𝗵𝗼𝘂𝗹𝗱 𝗯𝗲 𝗶𝗻 𝘁𝘄𝗼 𝗽𝗹𝗮𝗰𝗲𝘀:
1️⃣ The registry of the CA (you can see this in CA console)
2️⃣ The Configuration partition in Active Directory (query this with certutil)

Somehow — and I still don’t know why — the AD Config partition was 𝗺𝗶𝘀𝘀𝗶𝗻𝗴 the Request Certificates ACE (Enroll) for Authenticated Users.

✅ Re-added the Read + Enroll rights
✅ Waited a minute
✅ Auto-enroll worked perfectly

Just wanted to share this with you — in case you ever run into the same headache.