Repair SPN delegation after domain upgrade

For /certsrv, the failure is typically a Kerberos constrained delegation problem on the server hosting Certificate Authority Web Enrollment, especially when CA Web Enrollment is hosted on a different server than the CA.

Use this repair path:

1. Verify the web enrollment site is using HTTPS, not HTTP. Certificate web enrollment must use SSL.
2. If CA Web Enrollment is hosted on a server other than the CA server, enable Kerberos constrained delegation on the computer account of the server hosting the CAWE role.
3. In Active Directory Users and Computers, open the properties of the account that performs the front-end service role:
   • If the service runs under a custom service account, open that user account.
   • Also open the computer account of the front-end server, because that account must also be configured for delegation.
4. On the Delegation tab, configure:
   • Trust this user for delegation to specified services only
   • Use any authentication protocol
   This enables protocol transition, which is required in scenarios where constrained delegation must work across the front-end to the back-end service.
5. Make sure the delegation target list includes the back-end service. If needed, use Add to add the service, or add a common service class such as HOST for the back-end server.
6. If a custom service account is used for the front-end service, also verify:
   • The account is in either the local Administrators group or IIS_Users on the web server.
   • On Account settings, Account is sensitive and cannot be delegated is not selected.
7. Check topology:
   • Standard constrained delegation requires the front-end and back-end services to be in the same domain.
   • If they are in different domains or different trusted forests, use resource-based constrained delegation (RBCD) instead.
8. Verify SPN and application alignment if IIS is involved:
   • Confirm the application pool identity matches the account that owns the required SPN.
   • Verify the SPN exists for the service account by using setspn.
   • Ensure only one instance of the SPN exists.
9. In IIS, check Windows authentication settings for the application:
   • Go to Configuration Editor for the application.
   • Open system.webServer/security/authentication/windowsAuthentication.
   • Set UseAppPoolCredentials to True.
10. If Kerberos tickets were cached before the repair, purge cached Kerberos tickets on the back-end server after making changes:

Get-WmiObject Win32_LogonSession | Where-Object {$_.AuthenticationPackage -ne 'NTLM'} | ForEach-Object {klist.exe purge -li ([Convert]::ToString($_.LogonId, 16))}

11. If the site still returns HTTP 500 or 401-style back-end authentication failures, test the application directly from the connector/front-end host using the internal URL and confirm the app is actually negotiating Kerberos rather than NTLM.

For certificate enrollment specifically, the key fixes are: HTTPS enabled, KCD enabled on the CAWE hosting server, and delegation set to “Use any authentication protocol” so protocol transition works.

• Not able to request certificate using web enrollment
• Troubleshooting Kerberos constrained delegation issues
• Troubleshoot Kerberos constrained delegation