I am having an odd problem with a Code Signing certificate request from my Windows 10 workstation. We have a Windows Server 2012R2 CA setup with the Code Signing template and everything works fine if I do the request from another machine. But, if I do the request through MMC->Certificates->Current User->Request New Certificate I get the error:
The EMail name in unavailable and cannot be added to the Subject or Subject Alternate name. 0x80094812 (-2146875374 CERTSRV_E_SUBJECT_EMAIL_REQUIRED)
If I look at the failed request on the server I see the same error but the requester name is incorrect. Instead of my user name (DOMAIN\User) I see my admin user name (DOMAIN\UserAdmin). This obviously fails as my admin user does not have an AD email address.
I cannot for the life of me figure out where the request is getting my admin name from? If I look at my workstations event log I see the following error:
- System
- Provider
[ Name] Microsoft-Windows-CertificateServicesClient-CertEnroll
[ Guid] {54164045-7C50-4905-963F-E5BC1EEF0CCA}
[ EventSourceName] CertEnroll
- EventID 13
[ Qualifiers] 49754
Version 0
Level 2
Task 0
Opcode 0
Keywords 0x80000000000000
- TimeCreated
[ SystemTime] 2021-01-19T13:27:15.5372014Z
EventRecordID 118908
Correlation
- Execution
[ ProcessID] 0
[ ThreadID] 0
Channel Application
Computer workstation.domain.com
- Security
[ UserID] S-1-5-21-507921405-651377827-682003330-2622
- EventData
Context DOMAIN\user
TemplateName CodeSigningCertificate
CA CertServ.domain.com\Domain-Issuing-CA
RequestId 12919
ErrorCode The EMail name is unavailable and cannot be added to the Subject or Subject Alternate name. 0x80094812 (-2146875374 CERTSRV_E_SUBJECT_EMAIL_REQUIRED)
So it looks like it is making the request with my standard user but the server gets the request with my admin user.
Any ideas?
If you see different requester name, then it may indicate that either, you logged in with wrong account or application (MMC.exe or certmgr.msc) has hardcoded credentials to run in elevated mode with admin user credentials. This is configured through Compatibility tab in executable/shortcut properties.
User contributions licensed under CC BY-SA 3.0