Fixing Error 0x80090022: KBR Autoenrollment Failure in Windows Server CEP/CES

Table of Contents

This article provides solutions to address the issue where Certificate Enrollment Policy Web Service (CEP) and Certificate Enrollment Web Service (CES) autoenrollment using key-based renewal (KBR) fails on clients that are not joined to a domain. When this failure occurs, you may encounter the error message “0x80090022 NTE_SILENT_CONTEXT”. This guide will help you diagnose and resolve this specific error, ensuring smooth certificate autoenrollment for your non-domain-joined clients.

Understanding the Scenario¶

In scenarios involving non-domain-joined clients, you might configure CEP/CES for initial enrollment using a username and password, alongside certificate Key-Based Renewal (KBR). This setup allows clients to obtain initial certificates using user credentials and subsequently renew them automatically using KBR. For a detailed understanding of this configuration process, refer to documentation on configuring Certificate Enrollment Web Service for certificate key-based renewal on a custom port.

While the initial certificate enrollment process using certlm.msc and Active Directory account credentials might succeed, the subsequent KBR renewal process often fails. This failure manifests both when triggered automatically by the system and when initiated manually using the certreq -machine -q -enroll -cert <thumbprint> renew command-line tool.

During the failed KBR certificate renewal attempt, the CertEnroll.log file records the error “0x80090022 (-2146893790 NTE_SILENT_CONTEXT)”. Reviewing the log file, you might find entries similar to the following:

2032.4155.0:<DateTime>: 0x0 (WIN32: 0): https://ws2019cepces.contoso.lab/KeyBasedRenewal_ADPolicyProvider_CEP_Certificate/service.svc/CEP
...
https://ws2019cepces.contoso.lab/KeyBasedRenewal_ADPolicyProvider_CEP_UsernamePassword/service.svc/CEP
...
3002.676.0:<DateTime>: 0x803d0013 (-2143485933 WS_E_ENDPOINT_FAULT_RECEIVED)
3002.690.0:<DateTime>: 0x803d0013 (-2143485933 WS_E_ENDPOINT_FAULT_RECEIVED): A message containing a fault was received from the remote endpoint. 0x803d0013 (-2143485933 WS_E_ENDPOINT_FAULT_RECEIVED)
3002.744.0:<DateTime>: 0x803d0013 (-2143485933 WS_E_ENDPOINT_FAULT_RECEIVED): https://ws2019cepces.contoso.lab/KeyBasedRenewal_ADPolicyProvider_CEP_Certificate/service.svc/CEP
...
2032.1371.0:<DateTime>: 0x80090022 (-2146893790 NTE_SILENT_CONTEXT)
450.201.0:<DateTime>: 0x1 (WIN32: 1 ERROR_INVALID_FUNCTION): Error
450.202.0:<DateTime>: 0x825a0044 (-2108030908)
450.219.0:<DateTime>: 0x0 (WIN32: 0): Local system
...
450.219.0:<DateTime>: 0x2 (WIN32: 2 ERROR_FILE_NOT_FOUND): Provider could not perform the action since the context was acquired as silent. 0x80090022 (-2146893790 NTE_SILENT_CONTEXT)

These log entries provide valuable clues to the underlying cause of the KBR failure. Let’s investigate the potential reasons behind this error.

Possible Causes of Error 0x80090022¶

The error “0x80090022 NTE_SILENT_CONTEXT” in the context of CEP/CES KBR renewal can be attributed to several factors. However, in many cases, the reported “0x80090022 NTE_SILENT_CONTEXT” error can be misleading, masking a more fundamental issue. Let’s examine the primary causes:

1. Misleading Error Reporting: The “0x80090022 NTE_SILENT_CONTEXT” error presented in the client user interface might not be the root cause. A more critical error, “0x803d0013 WS_E_ENDPOINT_FAULT_RECEIVED,” often precedes it in the CertEnroll.log. This underlying error provides a more accurate direction for troubleshooting.

2. Unsupported Certificate Template Validity or Renewal Periods: Incorrect configurations in the certificate templates intended for client certificates can hinder autoenrollment. Specifically, inappropriately short validity or renewal periods can lead to renewal failures and potentially trigger the observed errors.

Let’s delve deeper into each of these potential causes and explore effective resolutions.

Misleading Error: NTE_SILENT_CONTEXT vs. WS_E_ENDPOINT_FAULT_RECEIVED¶

As mentioned earlier, the error message displayed to the user, “0x80090022 NTE_SILENT_CONTEXT,” can be a red herring. The more significant error to investigate is often “0x803d0013 WS_E_ENDPOINT_FAULT_RECEIVED,” which is typically logged earlier in the CertEnroll.log.

The confusion arises due to the endpoint priority configuration within CEP/CES. In a KBR renewal scenario, the certificate_CES endpoint is designed to execute first. If this endpoint fails (as it should in the username/password initial enrollment and KBR renewal scenario for non-domain joined machines), the system falls back to the username_password_CES endpoint. However, the username_password_CES endpoint is designed for initial enrollment and expects user interaction (username and password input), which is not available or intended during an automated KBR renewal. This mismatch leads to the “0x80090022 NTE_SILENT_CONTEXT” error, as the system attempts an operation in a “silent context” where user input is required but not provided.

Therefore, when troubleshooting, prioritize investigating the “0x803d0013 WS_E_ENDPOINT_FAULT_RECEIVED” error. This error indicates a failure in communication with the CEP/CES endpoint and points towards network connectivity or configuration issues.

Potential Causes for WS_E_ENDPOINT_FAULT_RECEIVED¶

The “0x803d0013 WS_E_ENDPOINT_FAULT_RECEIVED” error can stem from several network-related or configuration problems:

• Blocked RPC or DCOM Ports between CES and CA: Communication between the Certificate Enrollment Service (CES) and the Certification Authority (CA) server relies on Remote Procedure Call (RPC) and Distributed Component Object Model (DCOM). If the necessary ports for RPC or DCOM are blocked by firewalls or network security policies between the CES server and the CA server, communication will fail, resulting in the “WS_E_ENDPOINT_FAULT_RECEIVED” error.

• Blocked RPC or DCOM Ports between CA and Domain Controllers: Similarly, the CA server needs to communicate with domain controllers for various operations, including accessing Active Directory information related to certificate templates and user accounts. If RPC or DCOM ports are blocked between the CA server and domain controllers, it can disrupt the certificate enrollment process and lead to the same endpoint fault error.

• CEP/CES Application Configuration Issues in IIS: Incorrect configurations within the Internet Information Services (IIS) hosting the CEP/CES applications can also cause communication failures. A common configuration issue involves site bindings in IIS.

  To address potential IIS configuration problems, specifically regarding multiple site bindings, ensure the following setting is added to the <system.serviceModel> section of the Web.config file for your CEP/CES application:

  <serviceHostingEnvironment multipleSiteBindingsEnabled="true"/>
  

  This setting is crucial when you have multiple websites or applications hosted on the same IIS server and helps resolve potential conflicts related to service bindings.

By carefully examining these potential causes for the “WS_E_ENDPOINT_FAULT_RECEIVED” error, you can systematically troubleshoot and resolve the underlying communication problems hindering KBR autoenrollment.

Resolving Certificate Template Validity and Renewal Period Issues¶

Another critical aspect to consider for successful certificate autoenrollment is the configuration of the certificate templates used for client certificates. Incorrectly configured validity and renewal periods within these templates can directly impact the autoenrollment process.

For certificate autoenrollment to function reliably, it is essential to ensure that the certificate template is configured with appropriate validity and renewal periods. Specifically, the certificate template’s validity period should be set to a minimum of five days, and the renewal period should be at least one day.

These minimum values provide sufficient time for the autoenrollment process to initiate and complete successfully before certificate expiry. Shorter validity or renewal periods might not allow enough time for the system to detect the need for renewal, contact the CEP/CES servers, and obtain a new certificate, potentially leading to renewal failures and service disruptions.

To verify and adjust these settings, access your Certification Authority management console, locate the relevant certificate template, and review the “Validity Period” and “Renewal Period” settings under the “General” tab or equivalent settings location depending on your CA version. Modify these values to meet the recommended minimums or adjust them further based on your organization’s specific security and operational requirements.

By ensuring that your certificate templates have adequate validity and renewal periods, you can mitigate potential issues related to premature certificate expiry and improve the robustness of your certificate autoenrollment infrastructure.

Conclusion¶

Resolving error “0x80090022 NTE_SILENT_CONTEXT” in CEP/CES KBR autoenrollment for non-domain-joined clients often involves looking beyond the surface error message. By focusing on the underlying “0x803d0013 WS_E_ENDPOINT_FAULT_RECEIVED” error and carefully examining network connectivity, IIS configurations, and certificate template settings, you can effectively diagnose and fix the root causes of KBR autoenrollment failures. Remember to verify RPC/DCOM port accessibility, review IIS Web.config configurations for multiple site bindings, and ensure appropriate validity and renewal periods are set in your certificate templates. Addressing these key areas will contribute to a more stable and reliable certificate autoenrollment environment.

Do you have any further questions or experiences with this error? Feel free to share your thoughts and comments below!