Certificate Authority does not show Templates

No templates are shown in the Template folder of the Certificate Authority. In the Certificate Templates (certtmpl.msc) are Templates shown. Running certutil -CATemplates returns 0x80070490 (WIN32: 1168 ERROR_NOT_FOUND) CertUtil: Element not found. Restarting the service did not help Sreenshot of CN=OID shows the following result enter image description here There are also no entries under CN:Enrollment Services enter image description here

Mister 832 asked Nov 17, 2018 at 16:00 Mister 832 Mister 832 149 1 1 gold badge 2 2 silver badges 9 9 bronze badges

Does CN=OID container has entries in Active Directory? You can view them in ADSI Edit ( adsiedit.msc ) under CN=OID, CN=Public Key Services, CN=Services, container.

Commented Nov 17, 2018 at 16:06 See update in question Commented Nov 17, 2018 at 16:12

3 Answers 3

It looks like that your templates are ok and OIDs are ok as well.

Try to restart certificate service ( certsvc ) on new CA and check if templates are loaded. If this doesn't help, then stop certsvc on CA, then remove templates in CA record under CN=Enrollment Services, CN=Public Key Services, CN=Services, . Open CA record, navigate to certificateTemplates attribute:

  1. record a list of certificate templates you see them (just write somewhere).
  2. clear list by removing all entries from this attribute.
  3. Open Certification Authority MMC snap-in ( certsrv.msc ), start certsvc and try to add templates manually from the record you made in step 1.

Screenshot of certificateTemplates entry

898 5 5 silver badges 17 17 bronze badges answered Nov 17, 2018 at 16:19 7,247 1 1 gold badge 17 17 silver badges 35 35 bronze badges Sorry, but does new CA mean, I should reinstall the certificate Authority? Commented Nov 18, 2018 at 8:59 Where did I say about new CA? Commented Nov 18, 2018 at 9:01

Sorry, I misread it. Well, stopping an restarting certsvc did not help. BTW: Thank you for your good answer!

Commented Nov 18, 2018 at 9:06

I've deleted the objects under CN=Certificate Templates. After that, when I select Templates in CA, I asked if I wanted to reinstall the templates, since none where found. However, after that, the CA Templates did still not appear. If I right-click on Template-->New, the option template is disabled.So, I've created one pKICertifacte in ADSI-Editor. Restarted the service, but the result was still the same. The Template does not show up

Commented Nov 18, 2018 at 9:14

You did everything wrong. I asked to delete a list of certificate templates from attribute ander CA record in Enrollment Services container. I didn't say anything about Certificate Templates DS container. Also, I didn't ask to restore the list of templates in ADSI Editor, I asked to do this from Certification Authority MMC snap-in.

Commented Nov 18, 2018 at 9:36

I had similar issues and the above helped solve it. When I checked permissions of each template, I found that these did not have Enterprise Admins and Domain Admins on all of them.

so deleted them all from ADSIEDIT.msc The ran certutil -installdefaulttemplates from the certificate server to recreate the default certificate templates. If you have any custom certificates, you might want to check and just add permissions to them instead.

answered May 22, 2019 at 8:04

I recently moved my Enterprise CA from a Server 2019 DC to a dedicated Server 2022 system. Unfortunately after the migration I had several issues because I followed a third party guide instead of the official Microsoft guide. The microsoft guide included a couple of important pieces of information about keep the name of the server the same (or making changes to reflect the change) and publishing CRLs to the old namespace.

The other thing that happened apparently is that the flags for our CA were not properly designating our CA as enterprise.

After you have verified that you actually have an Enterprise CA, let’s look at the CA object in ADSIEdit.msc and make sure the flag that identifies it as an Enterprise CA is set correctly. It is very unusual to see the flag set incorrectly, but all the same it is possible. As we did before, launch ADSIEdit.msc, then expand CN=Configuration | CN=Services | CN=Public Key Services | CN=Enrollment Services. Right click the CA in the right pane that you want to enroll from and click properties. Find the flags attribute; and verify that it is set to 10. If it isn’t set to 10, then set it to 10 using ADSIedit.msc and allow for Active Directory replication to complete.

Our flag was set to 2. I stopped the CertSvc, changed the flag to 10, restarted the CertSvc and presto chango, the templates were available again.