A 500 from /certsrv/mscep/mscep.dll means the NDES application started but failed while
processing the request. Unlike a 503 (pool down), NDES is alive and misconfigured or unable
to do its job — usually template configuration, its RA certificates, or reaching the CA.
HTTP 500
NDES returns HTTP 500 Internal Server Error
What it means
Common causes
The certificate template names configured under
HKLM\SOFTWARE\Microsoft\Cryptography\MSCEP(EncryptionTemplate, SignatureTemplate, GeneralPurposeTemplate) do not exist on the CA or the service account lacks Enroll permission on them.NDES RA certificates are missing or expired, so NDES cannot sign or decrypt SCEP messages.
The issuing CA is unreachable or refusing the NDES server's requests (DCOM permissions, CertSvc stopped).
How to fix it
Compare the template names in
HKLM\SOFTWARE\Microsoft\Cryptography\MSCEPagainst the templates actually published on the CA — they must match the template name (not display name) exactly.On the CA, confirm the NDES service account has Read and Enroll on the configured templates, and that the templates are added under Certificate Templates in certsrv.msc.
Test CA reachability from the NDES server with
certutil -pingand check Failed Requests on the CA for denials from the NDES account.After any registry or certificate fix, run
iisresetso NDES re-reads its configuration.