Hello,
I recently deployed certificate services in my domain with an offline root and enterprise sub CA. Both CA's are Windows server 2012 R2. I deployed certificates to my domain controllers which are running
windows server 2008 R2.They both have a domain controller ceritificate, directory email replication cert, kerberos authentication cert, and domain controller authentication cert. I understand that having
those certs is a requirement for using smart card authentication for logging into domain joined machines.
However, when trying to login to a test box, the login prompt says "Smart card logons are not supported for your user account" and logs this error code 29 on the server "The KDC cannot find a suitable certificate to use for smart card
logons, or the KDC certificate could not be verified." it says to verify the existing KDC certificate which I do have.
I ran certutil -DCInfo, here are the results below:
0: dc1
1: dc2
*** Testing DC[0]: dc1
** Enterprise Root Certificates for DC dc1
No certs in Ent Root store!
Enterprise Root store: Cannot find object or property. 0x80092004 (-2146885628)
** KDC Certificates for DC dc1
Certificate 0:
Serial Number: 5e00000021c9558ac76ba3719b000000000021
Issuer: CN=domain-domainCERT2-CA, DC=domain, DC=company, DC=edu
NotBefore: 8/17/2016 8:55 AM
NotAfter: 8/17/2017 8:55 AM
Subject: EMPTY (DNS Name=dc1.domain.company.edu)
Non-root Certificate
Template: DomainControllerAuthentication, Domain Controller Authentication
Cert Hash(sha1): df 30 7e 54 60 18 70 c4 7e 29 df 83 30 c4 f6 4e fc 46 2e 78
Certificate 1:
Serial Number: 5e0000002225d1ae87690b5df8000000000022
Issuer: CN=domain-domainCERT2-CA, DC=domain, DC=company, DC=edu
NotBefore: 8/17/2016 8:55 AM
NotAfter: 8/17/2017 8:55 AM
Subject: EMPTY (DNS Name=dc1.domain.company.edu, DNS Name=domain.company.edu, DNS N
ame=company18)
Non-root Certificate
Template: KerberosAuthentication, Kerberos Authentication
Cert Hash(sha1): 80 a9 9d f0 ad a0 5b b7 c5 8c c2 b6 a4 1b ba d3 7d d2 3d d3
Certificate 2:
Serial Number: 5e000000203409520f347290f5000000000020
Issuer: CN=domain-domainCERT2-CA, DC=domain, DC=company, DC=edu
NotBefore: 8/17/2016 8:55 AM
NotAfter: 8/17/2017 8:55 AM
Subject: EMPTY (Other Name:DS Object Guid=04 10 34 df 2a 5d 38 31 b4 4a b7 42 09
fa 20 38 e9 1a, DNS Name=dc1.domain.company.edu)
Non-root Certificate
Template: DirectoryEmailReplication, Directory Email Replication
Cert Hash(sha1): 61 84 20 91 c7 1c 4f e4 4b e1 88 03 a8 74 1d bc 90 58 73 37
Certificate 3:
Serial Number: 5e0000001baca19c53df8c5cf600000000001b
Issuer: CN=domain-domainCERT2-CA, DC=domain, DC=company, DC=edu
NotBefore: 8/16/2016 9:55 PM
NotAfter: 8/16/2017 9:55 PM
Subject: CN=dc1.domain.company.edu
Certificate Template Name (Certificate Type): DomainController
Non-root Certificate
Template: DomainController, Domain Controller
Cert Hash(sha1): 4b ca 22 a6 9e b3 5e e0 4a 89 eb 02 82 53 7f b9 e1 ae 00 76
4 KDC certs for dc1
*** Testing DC[1]: dc2
** Enterprise Root Certificates for DC dc2
No certs in Ent Root store!
Enterprise Root store: Cannot find object or property. 0x80092004 (-2146885628)
** KDC Certificates for DC dc2
Certificate 0:
Serial Number: 5e0000001edf8589143a73cf4b00000000001e
Issuer: CN=domain-domainCERT2-CA, DC=domain, DC=company, DC=edu
NotBefore: 8/17/2016 8:54 AM
NotAfter: 8/17/2017 8:54 AM
Subject: EMPTY (DNS Name=dc2.domain.company.edu)
Non-root Certificate
Template: DomainControllerAuthentication, Domain Controller Authentication
Cert Hash(sha1): ef dc 99 b9 b1 e6 9a 44 d7 75 16 4d cc 7d 8c 8b 4f a5 f9 7f
Certificate 1:
Serial Number: 5e0000001d6abd55214627783f00000000001d
Issuer: CN=domain-domainCERT2-CA, DC=domain, DC=company, DC=edu
NotBefore: 8/17/2016 8:54 AM
NotAfter: 8/17/2017 8:54 AM
Subject: EMPTY (Other Name:DS Object Guid=04 10 f3 63 a4 3a 62 7d 77 46 9d d2 80
d2 1b ed 1e b4, DNS Name=dc2.domain.company.edu)
Non-root Certificate
Template: DirectoryEmailReplication, Directory Email Replication
Cert Hash(sha1): ab 4e 2f 89 8a 17 e0 37 85 99 0d 20 34 1f f0 7c 1f db 96 b1
Certificate 2:
Serial Number: 5e0000001c66ac691c9fb30aca00000000001c
Issuer: CN=domain-domainCERT2-CA, DC=domain, DC=company, DC=edu
NotBefore: 8/16/2016 10:06 PM
NotAfter: 8/16/2017 10:06 PM
Subject: CN=dc2.domain.company.edu
Certificate Template Name (Certificate Type): DomainController
Non-root Certificate
Template: DomainController, Domain Controller
Cert Hash(sha1): 93 a4 06 26 59 e3 77 a8 cd 88 26 41 13 e6 54 8b 74 c5 cb 52
Certificate 3:
Serial Number: 5e0000001fa7ab4fb12981c63000000000001f
Issuer: CN=domain-domainCERT2-CA, DC=domain, DC=company, DC=edu
NotBefore: 8/17/2016 8:54 AM
NotAfter: 8/17/2017 8:54 AM
Subject: EMPTY (DNS Name=dc2.domain.company.edu, DNS Name=domain.company.edu, DNS N
ame=company18)
Non-root Certificate
Template: KerberosAuthentication, Kerberos Authentication
Cert Hash(sha1): 1d ca ce 01 60 c0 8f 1c d2 72 99 07 20 41 34 99 b9 c2 dd 2c
4 KDC certs for dc2
CertUtil: -DCInfo command FAILED: 0x80092004 (-2146885628)
CertUtil: Cannot find object or property.
I've already tried renewing my KDC certs but that's not helping, any help would be appreciated.
Thanks!
Noah Dlugoszewski IT Administrator