Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I posted another question which seems to be getting nowhere, so maybe it was too specific (or I was on the wrong track).

I have OpenSSL clients which generate Certificate Signing Requests, which are sent to a Windows 2008 R2 Active Directory CA via SCEP. This is successful, and the certificates are issued.

Now I'd like to renew the certificates. I generate a CSR based off the existing certificate, sign it with the existing key and submit it. Windows CA rejects it, claiming an ASN1 error (bad tag).

Has anyone else done this before successfully? What steps could I take to troubleshoot it?

Thanks!

edit

So if I add the challenge password in the renewal request, Windows accepts it, but it puts it in pending status, not autorenewal. This tells me that Windows doesn't recognize that it's a renewal request at all and is treating it like a regular enrollment. If anyone has any ideas, I'm all ears.

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.