I posted another question which seems to be getting nowhere, so maybe it was too specific (or I was on the wrong track).
I have OpenSSL clients which generate Certificate Signing Requests, which are sent to a Windows 2008 R2 Active Directory CA via SCEP. This is successful, and the certificates are issued.
Now I'd like to renew the certificates. I generate a CSR based off the existing certificate, sign it with the existing key and submit it. Windows CA rejects it, claiming an ASN1 error (bad tag).
Has anyone else done this before successfully? What steps could I take to troubleshoot it?
Thanks!
edit
So if I add the challenge password in the renewal request, Windows accepts it, but it puts it in pending status, not autorenewal. This tells me that Windows doesn't recognize that it's a renewal request at all and is treating it like a regular enrollment. If anyone has any ideas, I'm all ears.
