Share via

You cannot download CA certificate from web enrollment pages

  • Article

On This Post

Symptoms

When you try to download CA certificate from web enrollment pages you get a prompt message with an unreadable proposed file name:

Do you want to save certnew_cer?ReqID=CACert&Renewal=1&Enc=bin (1,09 KB) from <ServerName>

https://www.sysadmins.lv/content/images/pages/1339/image_2_422286E1.png

And when you press the 'Save' button in the save file dialog nothing happens and the file is not saved. You cannot close 'Save File' pop-up prompt even if you press the 'Cancel' button.

↑ Back to the top

Cause

This issue occurs if you are using operating system listed in the 'Applies to' section and Internet Explorer with enabled Enhanced Security Configuration (ESC). Internet Explorer ESC applies strict security settings which prevent you from downloading CA certificate from web enrollment pages. For more information about IE ESC feature please read this article: Internet Explorer: Enhanced Security Configuration

↑ Back to the top

Resolution

You need to disable Internet Explorer Enhanced Security Configuration.

  1. Log in to the server with local administrator permissions;
  2. Click Start, Administrative Tools and click Server Manager;
  3. On the right pane click 'Configure IE ESC' link:
    https://www.sysadmins.lv/content/images/pages/1339/untitled_2_422286E1.png
  4. In the opened dialog box disable Internet Explorer ESC for appropriate group (Administrators and/or regular users).
  5. Click Ok and restart Internet Explorer.

Note

You should not disable Internet Explorer ESC for Administrators group. This is because by disabling this feature you increase the exposure of your server to potential attacks that can occur through Web content and application scripts. Instead, you should access web enrollment pages by using a regular user account and disable IE ESC for regular users only.

↑ Back to the top

Workaround

In an Active Directory environment you should avoid web enrollment pages usage directly from servers (machines that runs Windows Server operating system family). For management purposes you should use administrative computer that runs client operating system (Windows Vista/7) and with installed Remote Server Administration Tools (RSAT). 

↑ Back to the top

Applies to

  • Windows Server 2008 x86 and x64 all editions, full installation with Internet Explorer 8 or 9
  • Windows Server 2008 R2 all editions, full installation with Internet Explorer 8 or 9

↑ Back to the top