How can we fix the AD CS certificate enrollment web service  kerberos delegation failure ?

To restore CES enrollment without rebuilding the servers, verify and correct the constrained delegation path between the CES server and the issuing CA.

1. Confirm the topology. Constrained delegation requires the front-end service and back-end service to be in the same domain. If CES and the CA are in different domains or forests, use resource-based constrained delegation instead.
2. Make sure CES is using HTTPS. Certificate Enrollment Web Service requires SSL for client communication. If the CA web enrollment path is involved, the site must use https, not http.
3. Identify which CES service account model is in use. CES supports either:
   • a dedicated domain user account, or
   • the built-in IIS application pool identity.
4. If CES uses a dedicated domain user account, verify all of the following:
   • The account is a domain account.
   • The account is a member of the local IIS_IUSRS group on the CES server.
   • If Kerberos authentication or delegation is required, the account has an SPN registered. Example syntax: setspn -s http/<computername> <domainname>\<accountname>
   • In Active Directory Users and Computers for the CES service account, open Properties > Delegation and set:
     • Trust this user for delegation to specified services only
     • Use Kerberos only if CES was installed with Windows integrated authentication, or Use any authentication protocol if CES was installed with client certificate authentication
   • Add the issuing CA computer as the target and allow these services:
     • HOST
     • rpcss
   • In Account options, ensure Account is sensitive and cannot be delegated is not selected.
5. If CES uses the built-in application pool identity, configure the CES computer account for delegation. In Active Directory Users and Computers:
   • Open the CES server computer account Properties > Delegation
   • Select Trust this computer for delegation to the specified services only
   • Select Use Kerberos only
   • Add the target computer and allow:
     • HOST
     • rpcss
6. If the front-end runs under a custom service account, also verify the CES server computer account. The front-end server computer account must also be configured for delegation. In Computers > CES server Properties > Delegation:
   • Select Trust this user for delegation to specified services only
   • Select Use any authentication protocol
   • Ensure the back-end service list includes the CA service, or a common class such as HOST for the CA server.
7. If CES uses a built-in IIS account, verify IIS application pool settings. In IIS Manager > Application Pools > the CES app pool > Advanced Settings:
   • Process Model > Identity should be a built-in account such as NetworkService
   • Load User Profile should be True
   • Restart IIS if changes were made
8. Check for common causes behind the 401/delegation failure.
   • Missing or incorrect SPN on the CES service account
   • Delegation tab not available because the SPN was not created yet
   • CES hosted on a different server than the CA, but delegation to HOST and rpcss was not configured
   • CES and CA not in the same domain while using classic constrained delegation
   • RPC/DCOM connectivity blocked between CES and the CA, or between the CA and domain controllers
9. If CES key-based renewal is involved and logs show endpoint faults, also check IIS configuration. For CEP/CES application configuration issues, add: <serviceHostingEnvironment multipleSiteBindingsEnabled="true"/> to the <system.serviceModel> section of the Web.config file.

This is the shortest supported recovery path: correct the CES account type configuration, register the SPN if a user service account is used, configure delegation to the issuing CA for HOST and rpcss, verify HTTPS, and confirm RPC/DCOM connectivity. That addresses the documented causes of CES-to-CA Kerberos delegation failures without rebuilding CES or the CA.

References:

• Configure the Certificate Enrollment Web Service
• Troubleshooting Kerberos constrained delegation issues
• Not able to request certificate using web enrollment
• Error 0x80090022 NTE_SILENT_CONTEXT when CEP/CES autoenrollment using KBR fails on non-domain-joined clients