Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I posted another question which seems to be getting nowhere, so maybe it was too specific (or I was on the wrong track).

I have OpenSSL clients which generate Certificate Signing Requests, which are sent to a Windows 2008 R2 Active Directory CA via SCEP. This is successful, and the certificates are issued.

Now I'd like to renew the certificates. I generate a CSR based off the existing certificate, sign it with the existing key and submit it. Windows CA rejects it, claiming an ASN1 error (bad tag).

Has anyone else done this before successfully? What steps could I take to troubleshoot it?



So if I add the challenge password in the renewal request, Windows accepts it, but it puts it in pending status, not autorenewal. This tells me that Windows doesn't recognize that it's a renewal request at all and is treating it like a regular enrollment. If anyone has any ideas, I'm all ears.

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.