Windows Forum

Ask something
Discussion Locked

MS Cert Server and XP Pro WS

0 helpful
4 replies

by sfertic 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I have installed MS Cert Server on a 2000 Server as a stand alone Certificate Authority in a large LAN environment. It works on all PC's (Win95, 98, NT and 200) except SOME XP PC's. It hangs during the DOWNLOADING ACTIVE X when requesting the certificate via browser. I thought it was an IE6 issue, but 1 XP proved me wrong. I have compared all of the IE settings between working/nonworking XP PC's and cannot find the difference. What would keep 1 XP PC from downloading ActiveX and why is it timing out trying the find the CA? I will appreciate any suggestions, we hit a blank wall.

4 replies

by beermonster

Hi,
This will be flap all help for the minute, but there are a couple of mailings to the ntbugtraq listing about this which should at least let you strongly suspect that this is a bug rather than a config issue. I'll let you as and when any moreinfo is posted about it. Mail follows -

Issue: IE6 devices cannot create new Advanced Certificate requests via
form, as Active X component fails to download regardless of client
security settings.

Server :Win2000 Server (in workgroup) withMS Certificate Services
(standalone) regardless of service pack (although I have tested it with
Sp2 and Sp3) and Microsoft's unsupported public CA at

Client : Tested with - Win2K Sp3 & IE5 - OK
Win2K Sp3 & IE6 - Fails
WinXP Sp0 & IE6 - Fails
WinXP Sp1 & IE6 - Fails
WinXP Sp1 & IE6 Sp1 - Fails

Detail :
Attempting to use a local MS Cert Services CA instancefor IPSEC/Server
certificate generation.
1)From a client browser browse http://localCertServer/certsrv
2)Select 'Request a certificate', then 'Advanced Request'
3)Then 'Submit a cert req to this CA using a form'

A form is generated and a message displayed centrally saying
'Downloading ActiveX control' which I can only assume interrogates the
local CryptoAPI to work out what providers are available.

With older browsers the CSP field gets updated after the applet
installs, whereas IE6 never downloads.

The certificate server is within my local 'Local Intranet' zone and even
if the Security level is set to low, it still never works.

The problem has been reported to MS PSS and an incident raised, however
I was wondering if anyone had come up with a workaround.

by beermonster

Hi,
received this today -

http://www.microsoft.com/technet/security/bulletin/MS02-048.asp
Flaw in Certificate Enrollment Control Could Allow Deletion of Digital
Certificates (Q323172)

It sounds like you have this applied to either your client or your
server, but not both. This hotfix updates the enrollment control - the
reason why you're hanging on the advanced cert page, is because there's
a version mismatch between either your server or your client. Updating
both with the appropriate hotfix from the above URL should resolve the
problem.

by sfertic

Thank you for your help. You saved me a lot of time. Did you get points for that?

This discussion is closed to new replies.