Certsrv ошибка 500

• Remove From My Forums

• Question

• I am attempting to implement an Enterprise CA including web enrollment.  I have installed the role and role services, and the CA appears to function.  However, I receive HTTP error 500.19 when trying to browse the /certsrv virtual directory:

  Module	IIS Web Core
  Notification	BeginRequest
  Handler	Not yet determined
  Error Code	0x80070003
  Config Error	Cannot read configuration file
  Config File	\?C:Windowssystem32CertSrven-USweb.config

  Requested URL	http://server11.tec.local:80/certsrv
  Physical Path	C:Windowssystem32CertSrven-US
  Logon Method	Not yet determined
  Logon User	Not yet determined

  I receive HTTP 500 in all browsers, and the above when browsing localhost/certsrv.  I have researched and made many attempts to fix this, without luck.  I’ve modified NTFS ACLs on the system32CertSrv directory and subs, recreated the
  virtual directory with certutil -vroot, edited application pool settings, all to no avail.  The part that strikes me as an obvious problem is the lack of any web.config file in en-US, which the error points to.  However, as I said, I have recreated
  the directory with certutil after clearing out the IIS virtual directory.

  The server itself is a domain controller running Server 2008 R2 Enterprise SP1.  It runs DNS and all FSMO roles.  It also runs DHCP, file and print services, RDS Licensing (and Citrix licensing), and AD DS & CS as mentioned.  There
  is another server in the environment running Server 2003 SP2.  This is the «old» domain controller, which is also a certificate authority.  I am configuring AD CS for the purpose of being able to decommission the old server.  ADCS seems to be
  otherwise functioning, so I am hoping to avoid removing the role service itself.  

  Any thoughts?

  (I previously posted
  this in Directory Services and was told to move it here)

• Remove From My Forums

• Question

• I am attempting to implement an Enterprise CA including web enrollment.  I have installed the role and role services, and the CA appears to function.  However, I receive HTTP error 500.19 when trying to browse the /certsrv virtual directory:

  Module	IIS Web Core
  Notification	BeginRequest
  Handler	Not yet determined
  Error Code	0x80070003
  Config Error	Cannot read configuration file
  Config File	\?C:Windowssystem32CertSrven-USweb.config

  Requested URL	http://server11.tec.local:80/certsrv
  Physical Path	C:Windowssystem32CertSrven-US
  Logon Method	Not yet determined
  Logon User	Not yet determined

  I receive HTTP 500 in all browsers, and the above when browsing localhost/certsrv.  I have researched and made many attempts to fix this, without luck.  I’ve modified NTFS ACLs on the system32CertSrv directory and subs, recreated the
  virtual directory with certutil -vroot, edited application pool settings, all to no avail.  The part that strikes me as an obvious problem is the lack of any web.config file in en-US, which the error points to.  However, as I said, I have recreated
  the directory with certutil after clearing out the IIS virtual directory.

  The server itself is a domain controller running Server 2008 R2 Enterprise SP1.  It runs DNS and all FSMO roles.  It also runs DHCP, file and print services, RDS Licensing (and Citrix licensing), and AD DS & CS as mentioned.  There
  is another server in the environment running Server 2003 SP2.  This is the «old» domain controller, which is also a certificate authority.  I am configuring AD CS for the purpose of being able to decommission the old server.  ADCS seems to be
  otherwise functioning, so I am hoping to avoid removing the role service itself.  

  Any thoughts?

  (I previously posted
  this in Directory Services and was told to move it here)

• Remove From My Forums

• Question

• User1301250611 posted

  Have installed Certification Authority and Certification Authority Web Enrollement successfully but I am unable to browse to http:\localhostCertSrv

   I can see CertSrv virtual directory in my default web site.

   HTTP Error code 500 occurs on the browser…

  Any ideas of what might the problem could be?

   I have a gut feeling there’s a problem with .ASP permissions.

  Thanks in Advance!

\? is fine, its the hint to the file system related portions of Windows to enable full 32K sized path names (i.e. greater than 255 characters in a path). You can verify this by typing «\?C:» into a run box.

With that out of the way, can you post the contents of that web.config file?

See less

See more

See less

See more

See less

See more

Quote:

Originally Posted by tompsonn

Sorry things got nuts here. Anyway probably the better choice in the end

It’s fine tompsonn. Just a real PITA at this point having to revoke all the certs signed by the CA. And given that it was our domain’s only CA…