How can we fix the AD CS certificate enrollment web service  kerberos delegation failure ?

Martins Marco 0 Reputation points
2026-09-11T09:39:10.8233333+00:00

G'day

I have a question about fixing Kerberos delegation issues in our environment.

Currently, external devices fail to enroll for user certificates through CES and return 401 Unauthorized errors. After checking the logs, we found that Kerberos Constrained Delegation between CES and the issuing CA is broken.

We want to make sure certificate enrollment resumes smoothly without rebuilding the CES or CA servers.

Windows for business | Windows 365 Business
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. HLBui 11,820 Reputation points Independent Advisor
    2026-09-11T10:43:50.1466667+00:00

    Hi Martins Marco

    When CES tries to delegate to the CA using Kerberos Constrained Delegation and that link breaks, you’ll typically see those 401 Unauthorized errors from external devices. The good news is you don’t need to rebuild either CES or the CA servers. What you should do is check the delegation settings in Active Directory. Go into the service account properties that CES is running under and make sure the delegation tab is set to “Constrained Delegation” for the services HOST/<CA server> and rpcss/<CA server>. It’s also important to verify that the SPNs for both CES and the CA are registered correctly you can confirm with setspn -L <account>. Once those are fixed, restart the CES service and test certificate enrollment again. If the SPNs and delegation are aligned, requests should start flowing without the 401 blocks.

    If this explanation helps you get certificate enrollment working again, please hit “accept answer” so we know it was useful!

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-09-11T09:39:33.8766667+00:00

    To restore CES enrollment without rebuilding the servers, verify and correct the constrained delegation path between the CES server and the issuing CA.

    1. Confirm the topology. Constrained delegation requires the front-end service and back-end service to be in the same domain. If CES and the CA are in different domains or forests, use resource-based constrained delegation instead.
    2. Make sure CES is using HTTPS. Certificate Enrollment Web Service requires SSL for client communication. If the CA web enrollment path is involved, the site must use https, not http.
    3. Identify which CES service account model is in use. CES supports either:
      • a dedicated domain user account, or
      • the built-in IIS application pool identity.
    4. If CES uses a dedicated domain user account, verify all of the following:
      • The account is a domain account.
      • The account is a member of the local IIS_IUSRS group on the CES server.
      • If Kerberos authentication or delegation is required, the account has an SPN registered. Example syntax: setspn -s http/<computername> <domainname>\<accountname>
      • In Active Directory Users and Computers for the CES service account, open Properties > Delegation and set:
        • Trust this user for delegation to specified services only
        • Use Kerberos only if CES was installed with Windows integrated authentication, or Use any authentication protocol if CES was installed with client certificate authentication
      • Add the issuing CA computer as the target and allow these services:
        • HOST
        • rpcss
      • In Account options, ensure Account is sensitive and cannot be delegated is not selected.
    5. If CES uses the built-in application pool identity, configure the CES computer account for delegation. In Active Directory Users and Computers:
      • Open the CES server computer account Properties > Delegation
      • Select Trust this computer for delegation to the specified services only
      • Select Use Kerberos only
      • Add the target computer and allow:
        • HOST
        • rpcss
    6. If the front-end runs under a custom service account, also verify the CES server computer account. The front-end server computer account must also be configured for delegation. In Computers > CES server Properties > Delegation:
      • Select Trust this user for delegation to specified services only
      • Select Use any authentication protocol
      • Ensure the back-end service list includes the CA service, or a common class such as HOST for the CA server.
    7. If CES uses a built-in IIS account, verify IIS application pool settings. In IIS Manager > Application Pools > the CES app pool > Advanced Settings:
      • Process Model > Identity should be a built-in account such as NetworkService
      • Load User Profile should be True
      • Restart IIS if changes were made
    8. Check for common causes behind the 401/delegation failure.
      • Missing or incorrect SPN on the CES service account
      • Delegation tab not available because the SPN was not created yet
      • CES hosted on a different server than the CA, but delegation to HOST and rpcss was not configured
      • CES and CA not in the same domain while using classic constrained delegation
      • RPC/DCOM connectivity blocked between CES and the CA, or between the CA and domain controllers
    9. If CES key-based renewal is involved and logs show endpoint faults, also check IIS configuration. For CEP/CES application configuration issues, add: <serviceHostingEnvironment multipleSiteBindingsEnabled="true"/> to the <system.serviceModel> section of the Web.config file.

    This is the shortest supported recovery path: correct the CES account type configuration, register the SPN if a user service account is used, configure delegation to the issuing CA for HOST and rpcss, verify HTTPS, and confirm RPC/DCOM connectivity. That addresses the documented causes of CES-to-CA Kerberos delegation failures without rebuilding CES or the CA.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.