I am working on completing the migration from our SHA1 ADCS CA infrastructure to SHA256. We've been using the SHA256 CAs for some time with no issues. The last item to remain was to migrate our only group of users that have user client authentication
certificates from being issued SHA1 ones to SHA256 ones. Both CA infrastructures are running on Windows Server 2012 R2.
We'd been using the default "Client Authentication - User" template, but for a test I've cloned that policy to "TEST Client Auth - User". Only a single test user account has Enroll or Autoenroll rights on the template. The
template was added to our SHA256 intermediate CA to issue. There have been no other changes to the template. It's a version 2 template, with Windows Server 2003/XP compatibilty set.
When the test user logs in on my Windows 7 test computer, it does not successfully enroll in a certificate. I checked the intermediate CA and found this error:
Active Directory Certificate Services denied request 17778 because The certificate has invalid policy. 0x800b0113 (-2146762477 CERT_E_INVALID_POLICY). The request was for CN=test, OU=Users, OU=Test, DC=subdomain, DC=domain, DC=com. Additional information: Error Constructing or Publishing Certificate Invalid Issuance Policies: 1.3.6.1.4.1.311.21.8.1084316.5799510.12209843.6103771.9194518.172.1.400
Searching the Internet seems to point fingers at the Issuance Policy. I checked the SHA256 intermediate CA certificate and it says the certificate is intended for the following purposes: "All application policies".
I've never seen this error and am not quite sure how to solve it.
Here is my CAPolicy.inf file:
[Version]
Signature="$Windows NT$"
[Certsrv_Server]
RenewalKeyLength=2048
RenewalValidityPeriod=Years
RenewalValidityPeriodUnits=6
CRLPeriod=Days
CRLPeriodUnits=3
CRLDeltaPeriod=Days
CRLDeltaPeriodUnits=0
LoadDefaultTemplates=0
AlternateSignatureAlgorithms=1
I checked and we don't have AlternateSignatureAlgorithms set in the registry (at HKLM\SYSTEM\CurrentControlSet\Services\CertSvc\<CA name>\CSP\).
Any help would be appreciated. Thank you in advance!
