Hello,
I am using a certificate authority on Windows 2008 R2 enterprise. I have try without success to use SCEP (NDES) to enroll some cisco router
The router authenticate the Authority, but when I try to enroll I got an error 500 From IIS in the log
GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation&message=MII... (long message = certificate request)
When I copy the certificate request, correcting the % character and paste into the web GUI, I get an error 0x8009200e
(In french le message signé n'a pas de signataire pour l'index des signataires spécifiés)
crypto pki trustpoint O2-CA
enrollment mode ra
enrollment url http://serverFQDN:80/certsrv/mscep/mscep.dll
usage ike
serial-number none
fqdn NAMEofROUTER
ip-address none
subject-name C=FR, ST=Place O=o2, CN=FQDNof ROUTER ,E=Email
revocation-check none
rsakeypair NameOfKeyPair
crypto ca authenticate O2-CA Working
crypto ca enroll O2-CA Failed
No Error message in the event log or in the CAPI2 Event log
I already installed the hotfix to make the GetCACaps return something
I check that my user have access to the private key of the NDES certificate, and he is member of the IIS_IUSR Group
I already change the config of IIS to be able to accept url of 4096 characters
I can get a certificate for my router viw the Web UI,
only NDES is not working,
I don't know what to do next, if someone could help me
thanks in advance
JLO
