| Previous | Next |
| CERTSRV_E_SUBJECT_EMAIL_REQUIRED | CERTSRV_E_CERT_TYPE_OVERLAP |
CERTSRV_E_UNKNOWN_CERT_TYPE
CERTSRV_E_UNKNOWN_CERT_TYPE identifies a failure in template publication and lookup. The CA configuration references one or more certificate templates that it cannot resolve in the current directory view. Diagnose template publication and lookup at the first component that returned the value, not the last user-interface layer that displayed it; later cleanup and fallback attempts can produce different secondary errors.
Start with the returning API
In the CERTSRV_E_UNKNOWN_CERT_TYPE path, template-driven enrollment depends on Active Directory data visible to both the client and CA. A template can exist yet be unpublished, replicated inconsistently, inaccessible, or unable to derive a required subject value from the requester in a template publication and lookup investigation. For CERTSRV_E_UNKNOWN_CERT_TYPE, record the directory object and the CA’s actual view.
Diagnostic evidence matrix
- Template object DN, OID, version, publication on the target CA, and replication state
Confirm that the template object exists, is replicated, and is compatible with the CA version.
For CERTSRV_E_UNKNOWN_CERT_TYPE, links the status to the exact template or CA transaction. - Requester identity and directory attributes used for subject or SAN construction
Compare template display name, common name, and OID rather than relying on one label.
Preserves directory, request, and policy data evaluated by the CA when CERTSRV_E_UNKNOWN_CERT_TYPE is returned. - CA policy module events and the encoded template information in the request
Inspect the CA published-template list and Active Directory replication health.
In the CERTSRV_E_UNKNOWN_CERT_TYPE path, avoids treating a new enrollment as proof that the original request was fixed.
Preserve the evidence chain
For CERTSRV_E_UNKNOWN_CERT_TYPE, CA decisions depend on directory and transaction state at a particular moment. For CERTSRV_E_UNKNOWN_CERT_TYPE, correlate template modification and publication, Active Directory replication, request submission, request ID assignment, policy-module evaluation, disposition changes, and any client continuation. In the CERTSRV_E_UNKNOWN_CERT_TYPE path, this is especially important when a retry reaches a different domain controller or creates a new CA database row.
- For CERTSRV_E_UNKNOWN_CERT_TYPE, exported request and relevant attributes, template OID/version, CA configuration, and original request ID.
- CA operational events and request disposition history from the same transaction when CERTSRV_E_UNKNOWN_CERT_TYPE is returned.
- In the CERTSRV_E_UNKNOWN_CERT_TYPE path, directory evidence showing the template and requester attributes as visible to the CA at evaluation time.
Minimal test sequence
Query the same domain controller or directory view used by the CA, then enroll a known account with complete required attributes when CERTSRV_E_UNKNOWN_CERT_TYPE is returned. In the CERTSRV_E_UNKNOWN_CERT_TYPE path, compare the resulting request with the failing identity or template publication state.
| Test | Interpretation |
|---|---|
| Same input, known-good path | For template publication and lookup, success moves attention toward the selected provider, policy, device, context, or transaction state. |
| Known-good input, failing path | For template publication and lookup, failure suggests that the environment or selected object is independently unable to perform the operation. |
| Original path after one isolated change | For template publication and lookup, this comparison demonstrates whether the proposed correction addresses the original condition. |
Boundaries of this HRESULT
Enrollment permission problems occur after a template is found; this result indicates the template itself was not resolved. In the CERTSRV_E_UNKNOWN_CERT_TYPE path, typing a value into the request may not help when the template is configured to build the subject from directory data and reject supplied values.
For template publication and lookup, keep the original request and response pair; regenerating a key or submitting a new request may succeed while bypassing the policy or transaction state that produced this HRESULT.
Closure criteria
For CERTSRV_E_UNKNOWN_CERT_TYPE, the target CA must resolve the intended template and derive or accept the required identity data according to that template, without substituting another template. For CERTSRV_E_UNKNOWN_CERT_TYPE, keep a regression case that uses nonsecret identifiers and expected outcomes, including one negative control that must continue to fail.
Technical references
For CERTSRV_E_UNKNOWN_CERT_TYPE, these sources define the HRESULT and the relevant template publication and lookup interface, protocol, or data format.
- Microsoft Open Specifications: HRESULT values.
- Microsoft Open Specifications: Windows Client Certificate Enrollment.
- Microsoft: Certificate templates overview.
- Microsoft: certreq command.
Looking for a different code? Search another status or error code.