CCertRequest::Submit: Access is denied

[TheBZKing]

When I use the Get-IssuedRequest command I receive the information from the request.

Get-IssuedRequest -CertificationAuthority $CA1 -Filter "Commonname -eq server.test", "NotAfter -ge $(Get-Date)", "CertificateTemplate -eq Server Authentication"

But when I use the Submit-Certificaterequest command I receive the error CCertRequest::Submit: Access is denied. I use the same user account. Why can I read the information but not submit any? I've checked on the CA server and the Certificate template on the security tab and have all required options enabled.

Submit-CertificateRequest C:\Users\bzkking\Desktop\www.test.csr -CertificationAuthority $CA1 -Attribute "CertificateTemplate:WebServer(Manual)"

Note: I use an account form a different forest to submit the request.

[Crypt32]

I've checked on the CA server and the Certificate template on the security tab and have all required options enabled.

what options you are referring to?

In order to submit request to CA, the following minimum requirements must be met:

1. CA is up and running
2. Requested template is added to CA for issuance
3. Your user account has Enroll permissions on CA (by default, all authenticated users have this permission)
4. Your user account has Read and Enroll permissions on target template

Note, if you are using privileged groups (such as Domain Admins, Enterprise Admins, Administrators) in template permissions, PowerShell console MUST be launched in elevated mode, otherwise you will miss these group membership in security token.

[TheBZKing]

1. CA is up and running
   Yes, CA is up and running.
2. Requested template is added to CA for issuance
   Yes. I also use this template in CAWE
3. Your user account has Enroll permissions on CA (by default, all authenticated users have this permission).
   Yes, I explicitly added my account and checked all four checkboxes.
4. Your user account has Read and Enroll permissions on target template
   Yes.

I am sure it has nothing to do with the certificate template because when I run the command without the attribute certificatetemplate I get the same access denied message. While when I use this command with a Certificate Authority in the same forest I get the message:
Denied by Policy Module 0x80094801, The request does not contain a certificate template extension or the CertificateTemplate request attribute.

The weird thing is I can use the commando Get-IssuedRequest with the CA in another forest and get the results. But when I change it for Submit-CertificateRequest I get CCertRequest::Submit: Access is denied..

Is it possible to use an account in another forest within the command?

[Crypt32]

It seems you are using cross-forest enrollment. Then check if you fit requirements and configuration as outlined here: https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ff955845(v=ws.10)

You need to have a 2-way trust between forests and need to run the following command on your CA:

certutil - setreg Policy\EditFlags +EDITF_ENABLELDAPREFERRALS
Restart-Service CertSvc

[TheBZKing]

Yes, I have a CrossForest enrollment and already set this registry key. I am able to distribute certificates to different forests except this forest. Because PSPKI is able to read the certificate information from the CA-server I thought it would also submit a request, but it doesn't. Apparently this is because of the one-way trust.

Do you know why I am able to read the information but cannot submit? What is the big difference? Connection is already made, am I right?