Share via

Why when I deploy my roots and intermediate CA Certificates to AD do some servers automatically download them and others do not?

Chamby112 1 Reputation point
2020-10-22T14:35:26.24+00:00

I am very confused by the process of publishing Root and Intermediate certificates to AD and how they deploy to servers across an enterprise. When I publish the Root and Intermediate CA certs to the AIA and Certification Authorities Containers in AD, some servers will pull the new certificates into their trust stores and others will not.

When looking for any documentation around this process, I cannot find much. Does anyone out there know the process from beginning to end? Also, does anyone have an idea of why some would pull the certs from AD and others would not?

Thank you to anyone who can shed light on these dark times.

Windows for business Windows Client for IT Pros Directory services Active Directory
Windows for business Windows Server User experience Other
Windows for business Windows Server Devices and deployment Configure application groups
0 comments

12 answers

Sort by: Oldest
Most helpful Newest Oldest
  1. Thameur-BOURBITA 36,261 Reputation points Moderator
    2020-10-22T22:05:28.03+00:00

    Hi

    You can follow the link below:

    public-key-infrastructure-part-3-implement-pki-active-directory-certificate-services

    Please don't forget to mark this reply as answer if it help you to fix your issue

  2. Thameur-BOURBITA 36,261 Reputation points Moderator
    2020-10-22T23:04:17.147+00:00

    Hi,

    If you have installed enterprise PKI , all member machines will detect the certificate automatically when you restart it or run the following command manually: 

    certutil -pulse

    If the client is unable to detect the root certification automatically, I think it may be network flow issue.

    Please don't forget to mark this reply as answer if it help to fix your issue

    0 comments
  3. Chamby112 1 Reputation point
    2020-10-22T23:19:47.297+00:00

    This is where I'm getting to. This is not occurring on all of our systems. The large majority are, but I am seeing some that are not. I am trying to narrow down why they may not be updating on some. Are there instances others have seen where this is an issue? I.e. something disabled on the system, some GPO blocking this, etc.

    I am trying to understand the whole process so I can try and isolate it to something specific, but I cannot find a detailed description of the process end-to-end.

    0 comments
  4. Thameur-BOURBITA 36,261 Reputation points Moderator
    2020-10-22T23:25:46.613+00:00

    Try one of the following actions:

    • Check network flow
    • Restart impacted servers and launch the following command certutil -pulse
    • Rejoin impacted server to ___domain

    Please don't forget to mark this reply as answer if it help to fix your issue

  5. Thameur-BOURBITA 36,261 Reputation points Moderator
    2020-10-22T23:31:56.59+00:00

    When you say check Network flow, are you referring to network connectivity?

    Yes

    Please don't forget to mark this reply as answer if it help to fix your issue

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.