No certificates meet the application criteria

Question

Hello,

I deployed Enrollment Agent to be able to request certificate on behalf another users. It was working before but now when I request on-behalf I get following error message:
No certificates meet the application criteria.

any thoughts?

Answer 1

Hello @Bahram Maleki ,

Thank you for posting here.

I have done a test in my lab.

Configure "Enrollment Agent" certificate template.

1.Duplicate an "Enrollment Agent" certificate template, and give "domain users" group "Read" and "Enroll" permissions.

Certificate template display name is Enrollment Agent-1.

2.Issue this certificate template.

Daisy 11 requests certificate using certificate template named "Enrollment Agent-1".

3.Logon one client using domain user named daisy11.

4.Request certificate using certificate template named "Enrollment Agent-1" in user store.

Daisy11 is able to request certificate on behalf another user.

5.After that Daisy11 is able to request certificate on behalf another user (B\yu).

Because daisy11 has two certificates issued by "Enrollment Agent" certificate template, so it will prompt me to select one.

6.Select one certificate template for domain user (B\yu).

7.Selcet the user name(B\yu).

8.Daisy11 now request certificate for B\yu successfully.

From the error message, it seems there is no corresponding Enrollment Agent certificate in this current logged on user Store.

So please check:
1.Check if this current logged on user Personal Store has installed Enrollment Agent certificate using Enrollment Agent certificate template? If so, ensure this cert is not expired.

2.Check if this current logged on user Personal Store has installed Enrollment Agent certificate using Enrollment Agent certificate template? If there is no such certificate or such certificate has expired, this logged on user can request Enrollment Agent certificate using Enrollment Agent certificate template again, then request certs on behalf another users.

3.Find which user has already requested Enrollment Agent certificate using Enrollment Agent certificate template now. You can use the user account with Enrollment Agent certificate in his/her Personal Store to request certs on behalf another users.

Similar case.
Certificate services - request client certificates on behalf of another user?
https://social.technet.microsoft.com/Forums/windowsserver/en-US/ef1e7953-0e41-4465-becc-74305e18b32b/certificate-services-request-client-certificates-on-behalf-of-another-user?forum=winserversecurity

Reference
Enroll for Certificates on Behalf of Other Users
https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc770802(v=ws.11)?redirectedfrom=MSDN

Hope the information above is helpful.

Should you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 2

Thank you so much Daisy, But Still no luck, I am still getting following error:
"No certificates meet the application criteria"

It was working before but for somehow stopped working.

Thanks
BM

Answer 3

Hello @Bahram Maleki ,

Thank you for your update.

I have check one domain user without certificate issued using Enrollment Agent certificate template in user store.
The user is named B\yu.

Then I request certificate with logged on user B\yu on behalf another user, I received the same error as you mentioned above.

Would you please tell me whether you have troubleshooted as I mentioned above? If so, would you please tell me something above the result?

Should you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 4

here is the issue, I have enrollment agent but getting the error,

Thanks

Answer 5

Hello @Bahram Maleki ,

Thank you so much for your update.

1.Please check if the root certificate and certificate status is OK as below.

2.Check if this certificate is revoked or not.

Run command: certutil -urlfetch -verify <the full path of this cert>

For example:
certutil -urlfetch -verify C:\cer.cer

Cert is revoked.

Cert is not revoked.

3.Check the remaining lifetime of the root CA cert.

Should you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.