Problem in enrollment of certificate

waqar_...@yahoo.com

unread,

Jul 16, 2008, 8:43:10 AM7/16/08

to

Hi,
this is my first post.
We are using microsoft PKI 3 tier.
As an administrator i have enabled the key Archival option under the
certificate template properties.
Now when ever users try to enroll for the certificate (on which key
archival was enabled) from any other machine i.e. whether in workgroup
or domain they get the following error:

"An error occurred while creating the certificate request. Please
verify that your CSP supports any settings you have made and that your
input is valid.
Suggested cause:
No suggestion.
Error: 0x80092013 - (unknown)"

but whenever they logon to the Enterpirse CA and send request for
certificate enrollment they succeded.

Also if i uncheck the key Archival option under the certificate
template then users are able to enroll the certificate from any
location.

With regards,

krutz

unread,

Jul 17, 2008, 4:43:10 AM7/17/08

to

Have you generated a "Key Recovery Agent" certicates and configured it
in your CA?
Regards,
Kevin R.

krutz

unread,

Jul 17, 2008, 4:45:59 AM7/17/08

to

... Another thought, "Key Archival" is only available for Encryption
only templates, meaning that if you define "Signature & Encryption" in
your template, the Key Archival will not be supported.

Regards,
Kevin

On Jul 16, 2:43 pm, waqar_mohm...@yahoo.com wrote:

Paul Adare - MVP

unread,

Jul 17, 2008, 6:13:13 AM7/17/08

to

On Thu, 17 Jul 2008 01:45:59 -0700 (PDT), krutz wrote:

> ... Another thought, "Key Archival" is only available for Encryption
> only templates, meaning that if you define "Signature & Encryption" in
> your template, the Key Archival will not be supported.

This is not true. Key archival is supported for certificates that have
either Encryption or Signature and Encryption as their purpose.
It isn't supported for Signature only nor for Signature and Smartcard
Logon.

--
Paul Adare
MVP - Identity Lifecycle Manager
http://www.identit.ca
I am a computer -- dumber than any human and smarter than an administrator.

waqar_...@yahoo.com

unread,

Jul 18, 2008, 3:53:01 AM7/18/08

to

Yes i have generated a key archival agent at the ent ca.

marck.

unread,

Mar 17, 2010, 5:19:58 AM3/17/10

to

Hi,

We encountered the same issue, not able to request a certificate with the Archive Key option enabled from any other server / workstation then the CA itself.

After importing the latest CRL published by the CA on the server / workstation, we coult succesfully request certificates from that server / workstation.

Cheers.

waqar_mohman wrote:

Re: Problem in enrollment of certificate
18-Jul-08

Yes i have generated a key archival agent at the ent ca.

Previous Posts In This Thread:

On Thursday, July 17, 2008 6:13 AM
Paul Adare - MVP wrote:

Re: Problem in enrollment of certificate

On Friday, July 18, 2008 11:04 PM
waqar_mohman wrote:

Problem in enrollment of certificate

Hi,
this is my first post.
We are using microsoft PKI 3 tier.
As an administrator i have enabled the key Archival option under the
certificate template properties.
Now when ever users try to enroll for the certificate (on which key
archival was enabled) from any other machine i.e. whether in workgroup
or domain they get the following error:

"An error occurred while creating the certificate request. Please
verify that your CSP supports any settings you have made and that your
input is valid.
Suggested cause:
No suggestion.
Error: 0x80092013 - (unknown)"

but whenever they logon to the Enterpirse CA and send request for
certificate enrollment they succeded.

Also if i uncheck the key Archival option under the certificate
template then users are able to enroll the certificate from any
location.

With regards,

On Friday, July 18, 2008 11:04 PM
krutz wrote:

Have you generated a "Key Recovery Agent" certicates and configured itin your
Have you generated a "Key Recovery Agent" certicates and configured it
in your CA?
Regards,
Kevin R.

On Friday, July 18, 2008 11:04 PM
krutz wrote:

=2E..
=2E.. Another thought, "Key Archival" is only available for Encryption

only templates, meaning that if you define "Signature & Encryption" in
your template, the Key Archival will not be supported.

Regards,
Kevin

On Jul 16, 2:43=A0pm, waqar_mohm...@yahoo.com wrote:

On Friday, July 18, 2008 11:04 PM
waqar_mohman wrote:

Re: Problem in enrollment of certificate

Yes i have generated a key archival agent at the ent ca.

Submitted via EggHeadCafe - Software Developer Portal of Choice
SharePoint Video Library Template Available For Download
http://www.eggheadcafe.com/tutorials/aspnet/223c6e57-f81f-44b3-ab05-5995f2b0ab63/sharepoint-video-library.aspx