如果你使用CCertRequest.Submit，遇到Access is denied. 0x80070005错误

最新推荐文章于 2024-02-19 18:37:51 发布

梦想家起飞

最新推荐文章于 2024-02-19 18:37:51 发布

阅读量3k

点赞数

分类专栏： Win32开发文章标签： access windows button authentication microsoft domain

本文链接：https://blog.youkuaiyun.com/wingtrace/article/details/5788151

版权

Win32开发专栏收录该内容

1 篇文章

订阅专栏

可能你的情况会和我一样，假设

·CA（Certificate Authority）服务器是A（windows 2003之类），

·用作CA代理的服务器是B（开发环境的话XP之类），

·需要申请证书的机器是C（使用IE），

同时，

·A跟B不是同一台机器，

·或者不在同一个domain或ActiveDirectory，

·或者ActiveDirectory的用户权限及委派关系没有恰当配置；

那么在B执行(C/I)CertRequest.Submit的时候可能会出现

Access is denied. 0x80070005错误，这是一个来自DCOM的错误，

也可能会在B的eventlog发现这个消息。

经过诸多调查，发现我的问题不可能得到解决，

因为在我的工作环境下不方便配置domain或ActiveDirectory，

所以只好放弃A和B不是同一台机器的方案，只能暂且放到同一台机器上开发调试。

当然你的情况也可能完全和我不一样，无论如何以下一些文章是值得参考的：

1、来自

http://forums.techarena.in/server-security/385636.htm

的一篇文章，回答的部分摘录于此，全文请参考原文，错别字照原，不作修正：

※这篇文章的内容是否适用，一定要自己弄清楚来龙去脉，不要轻易尝试。。

Sory to answer your question so late but I have been working on this issue for a few days now and nobody on the net had the answer. Here are the simptoms of the problem:

1) You have installed a CA (Santd Alone) in machine A and a Web Enrollment Suport in machine B. Installation succeed ok. You access the page http://MachineB/certsrv and try to request a new certificate for you. After filling all fields you click the Submit button and get the message:

2) You have installed a CA (Enterprise) in machine A and a Web Enrollment Suport in machine B. Installation succeed ok. You whant to enable Basic Authentication on the page http://MachineB/certsrv for users outside your firewall because for them integrated auth does not work. You try to request a new certificate for you. After filling all fields you click the Submit button and get the message:

Error

Your request failed. An error occurred while the server was processing your request.
Contact your administrator for further assistance.
If you click on the details button you get:

Request Mode:
newreq - New Request
Disposition:
(never set)
Disposition message:
(none)
Result:
Access is denied. 0x80070005 (WIN32: 5)
COM Error Info:
CCertRequest::Submit Access is denied. 0x80070005 (WIN32: 5)
LastStatus:
The operation completed successfully. 0x0 (WIN32: 0)
Suggested Cause:
The Certification Authority Service has not been started.

I have contacted Microsoft support and I′m surprised that the solution is not published on th KB. So I will post it here:

Solution for the problem:

Stop IIS and open the metabase (c:/windows/system32/inetsrv/metabse.xml) file on Notepad.

Locate the string logonmethod and verify that under those 3 virtual directories of the web Enrollment the method is set to "2". Change all 3 values to "3" and save the file. It will resemble the following:

</IIsWebVirtualDir>
<IIsWebVirtualDir Location ="/LM/W3SVC/1/ROOT/CertControl"
AccessFlags="AccessRead | AccessScript"
AuthFlags="AuthAnonymous"
LogonMethod ="3"
Path="C:/WINDOWS/system32/CertSrv/CertControl"
>
</IIsWebVirtualDir>
<IIsWebVirtualDir Location ="/LM/W3SVC/1/ROOT/CertEnroll"
AccessFlags="AccessRead | AccessScript"
AuthFlags="AuthAnonymous"
LogonMethod ="3"
Path="C:/WINDOWS/system32/CertSrv/CertEnroll"
>
</IIsWebVirtualDir>
<IIsWebVirtualDir Location ="/LM/W3SVC/1/ROOT/CertSrv"
AccessFlags="AccessRead | AccessScript"
AppFriendlyName=""
AppIsolated="0"
AppRoot="/LM/W3svc/1/ROOT/CertSrv"
AuthFlags="AuthAnonymous"
LogonMethod ="3"
Path="C:/WINDOWS/system32/CertSrv"

One more detail: If the machine that you have installed the Web Enrollment Machine B does not belong tho the same domain it will be necessary to create on local account on both machine A and B wiht the same username and password (set it so it does not expire). On both machine ad this user to the goup Distributed COM users. On the CertSrv virtual directory on Machine B change the anonymous account to this account you have created.