Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

According to the MSDN article Renew an Exchange Certificate, I'm supposed to use

Get-ExchangeCertificate -Thumbprint 'AD19B141228C7CF98B5F78DCED978B7C45E15434' | New-ExchangeCertificate -GenerateRequest -PrivateKeyExportable $true

This will generate a CSR for me, which I send to our SSL certificate reseller through their SSL certificate renewal website. That site then promptly returns the following error:

[20022] CSR Country code invalid

Which isn't surprising, because the CSR doesn't contain any country code as far as I can tell.

In the past years, I've just bought a new certificate and replaced the old one. But I'd really like to understand what's going wrong with this renewal process.

share|improve this question
add comment

1 Answer 1

up vote 2 down vote accepted

As far as I know, this is supposed to grab your existing certificate, and make a new CSR with the same information (and I think a new key?).

Take a look at the output of Get-ExchangeCertificate and see if it contains a country code (C=XX appears in the subject DN of the certificate where XX is a 2-letter country code). If it does not, your old certificate didn't have one and you should make a new one with it. If it does, you might have found a bug and you won't be able to use this method.

Either way, it seems you should create a fresh new CSR.

share|improve this answer
    
Indeed. The Subject doesn't contain a country code either. Which is confusing, since I bought this certificate from the same reseller. So they're issuing certificates without a country code and then require it to be present when you renew? That's a bit confusing –  Oliver Salzburg Mar 17 at 11:20
    
They may have changed their policy to better align with that of other CAs, or they might just be applying it inconsistently. –  Falcon Momot Mar 17 at 11:22
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.