Technical Tip: FortiGate CSR submitted to Microsoft Active Directory certificate services rejected with 'Denied by Policy Module 0x80094801'

The reason this occurs is that Microsoft AD CS requires submitted CSRs to include a non-standard X.509 extension named 'CertificateTemplate'. This extension is not part of the defined extensions for the X.509 standard (refer to RFC 5280), and so the FortiGate does not support the addition of this extension when generating a CSR via the GUI or CLI.

To workaround this issue, it is recommended to first produce the CSR via the FortiGate, then to use the Windows certreq command on the AD CS server to append the CertificateTemplate attribute to the CSR as part of the import/signing process. As a reminder, consult the following documentation for guidance on creating the initial CSR on the FortiGate:

• Generate a CSR
  
• Technical Tip: Generate CSR via FortiGate CLI

Once the CSR has been created on the FortiGate, download and transfer it to the AD CS server. From there, run the following command on the AD CS server to both import the CSR and simultaneously append the appropriate CertificateTemplate attribute so that it is accepted by the policy module:

certreq -submit -attrib "CertificateTemplate:<template_name>" <certrequest.req-file>

The following example uses the 'Web Server' template that is one of the preconfigured options for AD CS, as well as a FortiGate-generated CSR named 'example_fortigate.csr'. Note that the value of the CertificateTemplate attribute must be set to the same as the actual name of the template that is configured on the Microsoft AD CS server:

certreq -submit -attrib "CertificateTemplate:Web Server" example_fortigate.csr

The above command should produce a certificate signed by the Microsoft AD CS certificate authority, after which it can be imported for usage on the FortiGate.

Related article:

Technical Tip: How to import PKCS#12 certificate