Customer installed Enterprise CA server in their AD forest and some Domain Controllers won’t pick up an SSL certificate.
The customer used LDP.exe to verify all of their DC to see if they had SSL enabled. They found a DC that did not pick up an SSL certificate.
The first thing to check is that the DC has been rebooted. The DC will obtain its SSL certificate upon a reboot.
The next thing to check is that the DC is set up to get its SSL certificate automatically.
Run GPEDIT.MSC, click on +Computer Configuration +Windows Settings +Security Settings then click on Public Key Policies and then Autoenrollment Settings and make sure it is set to "enroll certificates automatically" and make sure that renew and update are also checked.
Click Save and reboot the DC.
Now use LDP.exe to verify SSL communication.
If the DC still does not obtain the SSL certificate, here are some other items to check:
- Check and make sure the CERTSVC_DCOM_ACCESS group exists and has the proper groups assigned
To resolve this problem, follow these steps:
On the domain controller that hosts the certification authority, verify that the CERTSVC_DCOM_ACCESS group exists. To do this, follow these steps on the domain controller:
Click Start, click Run, type Dsa.msc, and then click OK.
In the console tree, click Users.
In the details pane, verify that the CERTSVC_DCOM_ACCESS group exists.
Add following groups to the CERTSVC_DCOM_ACCESS group:
The Domain Users group
The Domain Computers group
The Domain Controllers group
To update the DCOM security settings for the certificate service, run the following commands at a command prompt:
certutil -setreg SetupStatus -SETUP_DCOM_SECURITY_UPDATED_FLAG
net stop certsvc
net start certsvc
Note Press ENTER after each command.
Note: Information from https://support.microsoft.com/en-us/help/947237/the-autoenrollment-functionality-fails-when-a-windows-vista-based-computer-uses-version-2-v2-certificates