Direct Access NLS Certificate

[msi_school]

Hi

 

My NLS certificate has expired in Direct access, can someone point me to instructions on creating a new one.

 

I have generated a CSR and I believe I now have to generate a certificate from this request in the certificate authority MMC snap in but when I submit a new request I get the following error:

 

The request contains no certificate template information. 0x80094801 (-2146875391)

Denied by policy module 0x80094801, the request does not contain a certificate template request attribute

 

I can see the template in certificate template but I cant join the dots

 

Mike

[PeterH]

OK the dreaded certificate template request attribute. We had this issue when we tried to get a new NLS cert last year. I can't remember exactly what caused the error, but this is what we did in the end to get the certificate:

 

You need to identify which server hosts your enterprise CA and you need the Certification Authority Web Enrollment role service installed on it.

 

If you don't know which server this is on, you can find out by doing this at the command prompt:

 

certutil -config - -ping

 

(note the extra hyphen between -config and -ping)

 

Then we did this:

 

Create the CSR with:

Common Name: DA-server-name.domain

Cryptographic service provider: Microsoft RSA SChannel Cryptographic Provider

Bit Length: 2048

 

Then go to:

 

http://ca-servername.domain/certsrv

Request a certificate

Advanced cert request

Paste in the CSR

Select Certificate Template: Web Server

The certificate download should be offered. Download in DER format and save it somewhere

Now on your DA server, run certlm.msc

Personal/Certificates

Import

Browse for the cert that you saved

It should import OK - go to the properties and give it a friendly name you can identify

In the DA Setup/config, go step 3 - edit infrastructure servers

Click Browse to select a new cert - the new cert you just imported should be available to select

 

Couple of extra issues we had:

 

1. When requesting the cert, the web server template wasn't available to select. I think if you're not logged in as a Domain Admin, you don't get all the options. In the end we did it on the ca server itself and it was fine.

 

2. When we applied the configuration changes in DA, we got an error message saying the dns name was not available. After lots of faffing it turned out that the directaccess-nls.domain record in DNS did not exist. We re-created it, but every time we tried to apply the configuration changes in DA it got deleted again. I'm not sure if this is a known issue, but we ended up manually creating the directaccess-nls record, pointing it to the internal IP of the DA server. And then altered the permissions to remove Delete rights from Domain Admins and Authenticated Users. Then it worked OK.

 

3. Finally, on ours when we go into the DA dashboard, it still shows an error against Network Location Server, even though it is working fine. Even rebooting it hasn't cleared the error but it works fine so I've left it alone.

[msi_school]

Thank you @PeterH That worked, lucky we only have a handful of staff in school, this could have been a disaster under normal circumstances.

 

I am now off to catalog all my certificates and their expiries.