Fix CERTSRV_E_TEMPLATE_POLICY_REQUIRED (0X80094808) fast

What triggers this error

You see CERTSRV_E_TEMPLATE_POLICY_REQUIRED (0X80094808) when you try to enroll a certificate from a Windows Server CA. It usually happens after you create a custom certificate template. The CA tells you: "The template is missing a required signature policy attribute."

I've seen this mostly on Windows Server 2012 R2, 2016, 2019, and 2022. It happens when the template has version 3 (which is needed for newer features like key attestation) but the policy attribute isn't set right. You'll get this error right when the CA processes the request - not during template setup.

The 30-second fix: Reissue the template

This is the first thing to try. Often the template was created but not properly issued to the CA.

1. Open Certificate Templates Console on your CA server. Go to Start > Run > certtmpl.msc.
2. Find your custom template. Right-click it, choose Properties.
3. Go to the General tab. Check the Minimum Supported CAs dropdown. Make sure it says Windows Server 2012 or higher. If it's set to something older, change it.
4. Click Apply. Then right-click the template again and choose Reissue Certificate. You should see a prompt asking if you want to publish it.
5. Go to the Certificate Authority console (certsrv.msc). Right-click Certificate Templates under your CA, choose New > Certificate Template to Issue. Select your template.
6. Wait 30 seconds, then try your certificate request again. If it works, you're done. If not, move to the next step.

The 5-minute fix: Check the template version and policy attributes

If reissuing didn't help, the template version is probably wrong or the policy attribute is missing. Here's how to check.

1. In Certificate Templates Console, right-click your template, choose Properties.
2. Look at the General tab. Under Template Version, it should show Version 3. If it's Version 1 or 2, you need to change it. Version 3 is required for the policy attribute.
3. If it's not Version 3, you can't just change it in the GUI. You have to duplicate the template. Right-click the template, choose Duplicate Template. Give it a new name.
4. On the duplicate template, go to the Extensions tab. Look for Application Policies or Certificate Policies. You need at least one policy listed. If it's empty, click Add and pick something like Client Authentication or All Application Policies - whatever fits your use case.
5. Click OK. Then go to the Security tab and make sure the user or computer that requests the certificate has Enroll permission.
6. Now issue the duplicate template like you did in step 1: go to certsrv.msc, right-click Certificate Templates, choose New > Certificate Template to Issue, select your duplicate.
7. Try the enrollment again. If it still fails, move to the advanced fix.

The 15-minute fix: Edit the policy attribute directly in AD

Sometimes the GUI doesn't save the policy attribute correctly. You have to edit it in Active Directory using ADSI Edit. This is more involved, so follow exactly.

1. On your CA server, open ADSI Edit. If it's not installed, go to Server Manager > Add Roles and Features > Add AD DS and AD LDS Tools. Or just run dsamain.msc if available.
2. Connect to the Configuration partition. In ADSI Edit, right-click ADSI Edit at the top left, choose Connect to. Under Select a well known Naming Context, pick Configuration. Click OK.
3. Navigate to: CN=Services, CN=Public Key Services, CN=Certificate Templates, CN=YourTemplateName. Replace YourTemplateName with the actual name of your template.
4. Right-click the template object, choose Properties.
5. Find the attribute msPKI-Template-Schema-Version. Double-click it. Set the value to 3. Click OK.
6. Now find msPKI-Policy-Attributes. If it's missing entirely, you need to add it. Click New Attribute under the attribute list. Set the name to msPKI-Policy-Attributes and the value to something like 1.3.6.1.4.1.311.21.10.1 (this is the default code signing policy OID). Or you can use the OID from the policy you want.
7. Click OK. Then close ADSI Edit.
8. On the CA server, open a command prompt as administrator. Run certutil -setreg ca\CATemplateCacheInterval 0 then net stop certsvc && net start certsvc. This forces the CA to reload the template cache.
9. Wait 2 minutes. Then try your certificate request again. This fix usually works if the other steps failed.

Final check: What to do if it still fails

If none of these fixes work, you might have a deeper problem. Check the CA event logs under Applications and Services Logs > CertificateServices. Look for event ID 52 or 80. These usually give more detail about what attribute is missing.

Another thing I've seen rarely: if the template has custom OIDs that don't match the CA's policy, you'll need to add them to the CA's policy module. Open certsrv.msc, right-click your CA, choose Properties, go to Policy Module tab, click Properties, then add the OID to the list. But that's rare - 90% of the time one of the three fixes above will get you there.