AD Troubleshooting

AD and Domain-related issues and troubleshooting methods for Active Directory.

The certificate template requires too many RA signatures

The certificate template requires too many RA signatures

  • Comments 1
  • Likes

After copying the default Smartcard Logon or Smartcard User certificate template on a Windows 2008 R2 CA server, the template may not show up as selectable during Enroll on Behalf Of operations such as EOBO smartcard enrollment.

Clicking 'Show all templates' you may see the following error message for the template:

The certificate template requires too many RA signatures.  Only one RA signature is allowed.
Multiple request agent signatures are not permitted on a certificate request.

This is because Windows 2008 R2 requires an application policy to be defined for the EoBo operation (W2k3 did not enforce this requirement).

By default there is no number of authorized signatures defined (i.e. 0 signatures are allowed for the template - when you do an EoBo you therefore technically exceed the limit by 1).

Ticking the box as above allows the EoBo operation for the smartcard to succeed as it sets the number of allowed and required signatures to 1.


Further details:

Issuance Requirements:
http://technet.microsoft.com/en-us/library/cc753139(v=ws.10).aspx

Comments
  • Brilliant!  Was struggling with this, but great stuff!!!

Your comment has been posted.   Close
Thank you, your comment requires moderation so it may take a while to appear.   Close
Leave a Comment