Domain controller will not use cert from my Active Directory certificate services

hello -

i have created two-tier pki uses offline root ca , enterprise ca joined domain. able auto-enroll test 2012r2 server without apparent problem. problem comes in when try tcp 636 on dcs using these certs.

while see certs issued domain controller (one domain controller authentication, 1 kerberos authentication, , 1 directory email replication), see no cert being used on tcp 636 dc. when execute following command (which typically shows me certs on target, encrypted webserver or ldaps port), see following:

"source: schannel - event id 36869 - ssl server credential's certificate not have private key information property attached it. occurs when certificate backed incorrectly , later restored. message can indicate certificate enrollment failure".

the command using trigger is: openssl s_client -showcerts -connect mydc.example.com:636

the ssl certs brand new , looking @ each of them in mmc, have private key corresponds cert in question. thoughts appreciated.

i think figured out. in mmc snap-in, added certificates snap-in "services" , looked @ certs had been stored "active directory domain services". turns out had imported signed third-party ca cert ntds\personal...only cert , not corresponding key. looks directory services trying use couldn't since key wasn't present.

once removed cert ntds\personal, leaving section empty, domain controller began using cert internal pki , see tcp 636 using cert. thanks!

Windows Server  >  Windows Server 2012 General