cisco expressway -cannot recognize your service domain contact admin

[balaji.babu1]

Hello team,

After generating CSR in c and E i tried to create certificate in my domain sever , when a submit a new service request 

in certificate authority am getting this error , any idea 

regards

balaji

[balaji.babu1]

FYI , AD severs in windows 2008 r2 enterprice

[Jaime Valencia]

You can get a lot of info by googling the error

https://social.technet.microsoft.com/Forums/windows/en-US/298006b4-533b-4c88-a5fd-461ecf5a0a42/the-request-contains-no-certificate-template-information-0x80094801-2146875391-denied-by-policy?forum=winserversecurity

https://support.microsoft.com/en-us/help/910249/you-may-receive-a-the-request-contains-no-certificate-template-information-error-message-when-you-submit-a-csr-to-an-enterprise-ca-by-using-the-certification-authority-microsoft-management-console-mmc-snap-in-in-windows-server-2003

http://jermsmit.com/custom-certificate-request-errors-with-0x80094801/

[balaji.babu1]

Hi jaime,

Third thread helped me ,but now am getting error" The file provided does not have a client usage attribute. The certificate must be usable for both servers and clients for Unified Communications"

Even i have duplicated the web service template as u recommended in

the other thread but no luck

https://supportforums.cisco.com/discussion/12616916/expressway-c-certs

 

[Jaime Valencia]

And do you actually see those in the enhanced key usage in the certificate you signed?

[balaji.babu1]

Hi jaime,

when i check my issued certificates , it template show web server but i have issued a new template with the name client server ,not sure where it is getting failed.

[Jaime Valencia]

No idea what you're doing, but it says you're using the Web Server template to sign it.

[balaji.babu1]

Hi Jaime,

i have created a duplicate of web server template and named it as client sever as displayed in screenshot and  issued it, but still am get certified by web server template, thats my issue.

[Jaime Valencia]

OK, you might want to post this in MS support forums to get assistance with the CA not working properly. Or reach out directly to MS support if you have a contract.

[balaji.babu1]

Hi jaime,

After a long struggle i can able to resolve the issue with

the help of  below thread .

https://social.technet.microsoft.com/Forums/en-US/863cf2b6-e86f-4ce7-a7ca-831ec1e78ecd/how-to-issue-a-v3-certificate-from-windows-2008-r2-ca-server?forum=winserversecurity

regards

bala

[balaji.babu1]

Hi ,

I have created the setup and everything works internally with dns ,but when i connect from external network( here I use jabber on android ) am getting  “cannot recognize your service domain  contact admin” error

Am using godaddy for external dns server

Attached the logs herewith

[Alok Jaiswal]

Your issue is here.

Is your external domain is "cnsvoice.com"??

its not able to query for collab-edge.

2017-04-04 13:00:28,226 INFO [0xab7f0fb0] [nsutils/android/androidDnsQuery.cpp(256)] [csf.dns] [makeQuery] - The SRV record query for '_collab-edge._tls.cnsvoice.com.' has Failed with rcode 3
2017-04-04 13:00:28,228 WARN [0xab7f0fb0] [nsutils/android/androidDnsQuery.cpp(192)] [csf.dns] [makeDnsQuery] - *-----* DNS query _collab-edge._tls.cnsvoice.com. has failed: NAME_ERROR.
2017-04-04 13:00:28,228 INFO [0xab7f0fb0] [dge/EdgeDetectionControllerImpl.cpp(688)] [csf.edge] [gatherEdgeConnectivityInfo] - Finished evaluation with CollabEdgeServiceSensor. Edge Connectivity is 0

Regards,

Alok

[balaji.babu1]

HI alok, 

Thanks for the response 

This was my old thread ,i have found the issue and resolved.there was misc onfiguration in external dns server .post resolving this am able to resolve collab-edge.

current issues mentioned in the below thread ,need ur inputs on this

https://supportforums.cisco.com/discussion/13268316/cisco-expressway-cannot-communicate-server-error