Entrust PKI as a Service

Access denied by remote endpoint

When Enabling WSTEP for users and devices, the Windows machine may display the following error.

Error: Access was denied by the remote endpoint.
080300005 (-2143485947 WS_E_ENDPOINT_ACCESS_DENIED)

The sections below describe possible causes and their corresponding solutions.

Invalid enrollment URL

The CEP URL provided in Group Policy Management may contain a typo.

Issue resolution: Check that the entered URL matches the URL displayed on the welcome page of the Entrust PKIaaS UI.

Invalid agent configuration

The WSTEP agent configuration is not valid.

Issue resolution: Check the following.

  1. The WSTEP agent runs with a valid configuration before the PKIaaS CEP URL can be defined in a Group Policy Object.
  2. The WSTEP agent completes an initial synchronization of Kerberos data (SPN and KVNO) from RootAD before Group Policy Management can validate the PKIaaS CEP URL.

See Troubleshooting agent configuration issues for guidance on resolving agent-related issues.

Invalid root Active Directory username

The username defined in the Entrust PKIaaS UI for RootAD does not have properly configured SPN (Service Principal Name) or UPN (User Principal Name) values.

Issue resolution: Run the following command to fix the root Active Directory username.

ktpass /mapuser <user> /princ HTTP/<pkiaas-wstep-url>@<UPPERCASE-DOMAIN-NAME> /pass <pass> /ptype KRB5_NT_PRINCIPAL /target <DOMAIN-CONTROLLER> /crypto ALL

Where:

  • <user> is the RootAD service account user name in username@domain or domain\username format.

  • <pass> is the password of the RootAD service account specified by <user>.

     If the password contains special characters, enclose it in quotation marks.

  • <pkiaas-wstep-url> is the PKIaaS WSTEP URL host name used in the HTTP principal.

  • <UPPERCASE-DOMAIN-NAME> is the forest root domain name in uppercase format (for example, EXAMPLE.COM).

  • <DOMAIN-CONTROLLER> is the host name of the domain controller to use.