CERTSRV_E_SMIME_REQUIRED Fix: Missing SMIME Capabilities
This error hits when a certificate request doesn't include the SMIME capabilities extension. Common on Exchange or AD CS setups. Fix it by editing the request template.
When This Error Shows Up
You're trying to request a certificate from an internal AD CS (Active Directory Certificate Services) server. Maybe it's for Exchange Server 2016 or 2019, or some SMIME-enabled app. The request goes out, but the CA rejects it with CERTSRV_E_SMIME_REQUIRED (0x80094805). I've seen this exact thing happen on a client's Exchange 2019 CU13 server during a certificate renewal. The CA was Windows Server 2022 with the SMIME template flag set to required.
Root Cause
The CA's certificate template has the SMIME capabilities extension marked as mandatory. The request you're sending doesn't include that extension. It's like showing up to a job interview without a resume — the CA just says 'nope, not happening.' The SMIME extension tells the CA what algorithms and key usage the cert supports. Without it, the CA won't issue the cert.
The fix isn't complicated. You either modify the template to not require SMIME (if you don't need it) or you add the extension to your request. Most of the time, you don't actually need SMIME — it's just a default setting that got left on.
The Fix: Edit the Certificate Template
Step 1: Open the Certificate Templates Console
On your CA server, open Server Manager → Tools → Certificate Authority. Right-click Certificate Templates and select Manage.
Step 2: Find the Template You're Using
Find the template that matches the certificate you're requesting. Common ones for Exchange are Exchange Server or WebServer. Right-click it and choose Properties.
Step 3: Disable the SMIME Requirement
Go to the Extensions tab. In the list, look for Application Policies or Certificate Application Policies. Select it and click Edit. If you see an extension for SMIME or Secure Email, that's what's causing the issue. You can either remove it or — simpler — uncheck the box that says Critical next to it. But the real fix is to set it to not required.
Better yet, go to the Request Handling tab and check Allow private key to be exported if you need it. Then go to the Issuance Requirements tab and make sure This number of authorized signatures is set to 0. That stops the CA from requiring extra junk.
Step 4: Reissue the Template
Click OK to close properties. Back in the Certificate Authority console, right-click Certificate Templates → New → Certificate Template to Issue. Select the template you just edited and click OK. This pushes the updated template to the CA.
Step 5: Regenerate Your Request
On the machine where you need the cert, generate a new request. For Exchange, you'd run the Exchange Certificate Wizard again. Or if you're using certreq, create a new INF file and submit it.
; Sample certreq.inf
[Version]
Signature = "$Windows NT$"
[NewRequest]
Subject = "CN=mail.contoso.com"
KeyLength = 2048
KeySpec = 1
Exportable = TRUE
MachineKeySet = TRUE
ProviderName = "Microsoft RSA SChannel Cryptographic Provider"
RequestType = PKCS10
[EnhancedKeyUsageExtension]
OID = 1.3.6.1.5.5.7.3.1 ; Server Authentication
OID = 1.3.6.1.5.5.7.3.2 ; Client Authentication
[Extensions]
2.5.29.17 = "{text}"
_continue_ = "dns=mail.contoso.com&"
_continue_ = "dns=autodiscover.contoso.com"Run: certreq -new -config "CAServerName\CA Name" certreq.inf cert.req
Alternative: Add SMIME to the Request
If you need SMIME (like for email signing), you can add it to the INF file under [EnhancedKeyUsageExtension]:
OID = 1.3.6.1.5.5.7.3.4 ; Secure EmailBut honestly, 90% of the time you don't need SMIME. It's just a checkbox that someone left on.
What If It Still Fails?
Check the CA's event log. Look in Event Viewer → Applications and Services Logs → CertificateServices. The error there will tell you exactly which extension failed. Also confirm the template is actually published — I've had a client where the template was edited but not reissued to the CA. Restart the Certificate Services service after publishing: net stop certsvc && net start certsvc.
One more thing: if you're using a third-party tool like OpenSSL to generate the request, make sure you include the SMIME extensions in the config. But for internal AD CS, the template edit is faster.
Was this solution helpful?