Exception when using Get-CATemplate in a remote session

[michaeldcanady]

I am trying to fetch CA templates while is a PSRemoteSession, and I get the following exception:

> Connect-CertificationAuthority -ComputerName "<host FQDN>" | Get-CATemplate
New-Object : Exception calling ".ctor" with "1" argument(s): "An operations error occurred.
"
At C:\Program Files\WindowsPowerShell\Modules\PSPKI\4.2.0\Server\Get-CATemplate.ps1:14 char:13
+             New-Object PKI.CertificateServices.CATemplate -ArgumentLi ...
+             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [New-Object], MethodInvocationException
    + FullyQualifiedErrorId : ConstructorInvokedThrowException,Microsoft.PowerShell.Commands.NewObjectCommand

[Crypt32]

PSPKI is not officially supported in remote sessions, because it establishes remote connections internally and you run into "double hop" issue. You can try to use CredSSP in remote session, however it is not supported. You should use PSPKI locally and specify remote servers in -ComputerName parameter in applicable commands.

[michaeldcanady]

We're using Ansible for provisioning which requires a remote connection using WinRM. This is the only Cmdlet so far we've had this issue with.

[Crypt32]

Try it in remote session with CredSSP. Connect-CertificationAuthority makes connections to AD, which causes "double hop" and CredSSP should overcome this issue.

[michaeldcanady]

we're hesitant to enable CredSSP, out of curiosity would the double hop be avoided with Get-CertificationAuthority or does that use remote connections as well?

[Crypt32]

we're hesitant to enable CredSSP, out of curiosity would the double hop be avoided with Get-CertificationAuthority or does that use remote connections as well?

Get-CertificationAuthority and Connect-CertificationAuthority are almost identical with the exception that Get- connects to all discoverable CA servers, while Connect- only to local or specified. That is, replacing the command will not solve your issue.