Ondrej Sevecek's English Pages

If you have an offline certificate request file (usually Base-64 encoded REQ file), you cannot just submit it into an Enterprise type of Active Directory Certificate Services (AD CS) certification authority (CA). Enterprise CAs issue certificates exclusively on the bases of certificate templates. If the request does not contain information (Certificate Template Information extension - OID 1.3.6.1.4.1.311.21.7) about what certificate template the requestor wants to enroll the certificate with, you receive the following error:

Certificate Request Processor
The request contains no certificate template information
0x80094801 CERTSRV_E_NO_CERT_TYPE
Denied by Policy Module
The request does not contain a certificate template extension or the CertificateTemplate request attribute

The solution is quick and simple. You have to submit the request from command line with CERTREQ and you have to add a request attribute which specifies the name of the certificate template which is missing from the request. Note that you must specify the system (common) name of the template, not its display name. You will find its common name on the template's General tab in the box called Template name.

certreq -Submit -Attrib "CertificateTemplate:GOPASManualTLSServerCSP" -Config - offline-request.req

Note that the dash value for the Config parameter means that the request should be uploaded to local CA. If you wanted it to submit over DCOM to a remote certification authority, you would have to specify the value for the Config parameter in the form of server\CA instead. Such as in the following example:

certreq -Submit -Attrib "CertificateTemplate:GOPASManualTLSServerCSP" -Config "dc1.gopas.virtual\GOPAS Root Online CA" offline-request.req