| Previous | Next |
| CERTSRV_E_UNKNOWN_CERT_TYPE | CERTSRV_E_TOO_MANY_SIGNATURES |
CERTSRV_E_CERT_TYPE_OVERLAP
CERTSRV_E_CERT_TYPE_OVERLAP should be read at the template renewal and validity geometry boundary. The template renewal period extends beyond its validity period, leaving no coherent interval in which normal renewal behavior can be scheduled. For template renewal and validity geometry, the useful diagnostic question is which concrete object and operation caused Windows to select this exact HRESULT—not whether a key, certificate, account, file, or device merely “works.”
What the code establishes
For CERTSRV_E_CERT_TYPE_OVERLAP, the certification authority is evaluating the request against a published certificate template. Capture the template OID, display name, major and minor version, CA template publication state, key and subject settings, validity and renewal periods, and any authorized-signature requirements when CERTSRV_E_CERT_TYPE_OVERLAP is returned.
Facts to preserve before changing state
| Record | Why it matters for this code |
|---|---|
| template OID and version actually referenced by the request | For CERTSRV_E_CERT_TYPE_OVERLAP, links the status to the exact template or CA transaction. |
| CA configuration, published-template set, and directory replication view | Preserves directory, request, and policy data evaluated by the CA when CERTSRV_E_CERT_TYPE_OVERLAP is returned. |
| encoded request attributes, public-key properties, renewal state, and signer count | In the CERTSRV_E_CERT_TYPE_OVERLAP path, avoids treating a new enrollment as proof that the original request was fixed. |
Code-specific checks:
- Read the effective validity and renewal periods in consistent units.
- Check whether the issuing CA certificate lifetime imposes a shorter practical validity.
- Change template timing deliberately and allow replication before retesting enrollment.
Build a timeline before changing state
CA decisions depend on directory and transaction state at a particular moment when CERTSRV_E_CERT_TYPE_OVERLAP is returned. For CERTSRV_E_CERT_TYPE_OVERLAP, correlate template modification and publication, Active Directory replication, request submission, request ID assignment, policy-module evaluation, disposition changes, and any client continuation. This is especially important when a retry reaches a different domain controller or creates a new CA database row in a template renewal and validity geometry investigation.
- For CERTSRV_E_CERT_TYPE_OVERLAP, exported request and relevant attributes, template OID/version, CA configuration, and original request ID.
- CA operational events and request disposition history from the same transaction when CERTSRV_E_CERT_TYPE_OVERLAP is returned.
- In the CERTSRV_E_CERT_TYPE_OVERLAP path, directory evidence showing the template and requester attributes as visible to the CA at evaluation time.
Isolation procedure
In the CERTSRV_E_CERT_TYPE_OVERLAP path, submit a nonproduction request built directly from the same template with one known compliant key and identity. Then change only the policy dimension named by the status in a template renewal and validity geometry investigation. For CERTSRV_E_CERT_TYPE_OVERLAP, this avoids confusing template lookup, request construction, and CA issuance policy.
- Preserve the original input, identity, provider or protocol selection, and first return value for
CERTSRV_E_CERT_TYPE_OVERLAP. - Use one known-good control that changes only the suspected part of the template renewal and validity geometry path.
- For
CERTSRV_E_CERT_TYPE_OVERLAP, reverse the comparison with known-good input on the failing layer where that can be done safely. - Record where behavior first diverges in the template renewal and validity geometry path instead of judging only by the final application message.
Common wrong turns
This is a template design error rather than an individual request defect. For CERTSRV_E_CERT_TYPE_OVERLAP, issuing from another template can make enrollment succeed while producing a certificate with different EKUs, key policy, subject rules, or lifetime. Treat it as a comparison, not the repair when CERTSRV_E_CERT_TYPE_OVERLAP is returned.
For template renewal and validity geometry, keep the original request and response pair; regenerating a key or submitting a new request may succeed while bypassing the policy or transaction state that produced this HRESULT.
Proving the intended path works
The CA must accept a request that still uses the intended template and security policy, and the resulting certificate must contain the expected identity, usages, key, and lifetime in a template renewal and validity geometry investigation. For CERTSRV_E_CERT_TYPE_OVERLAP, keep a regression case that uses nonsecret identifiers and expected outcomes, including one negative control that must continue to fail.
Technical references
For CERTSRV_E_CERT_TYPE_OVERLAP, these sources define the HRESULT and the relevant template renewal and validity geometry interface, protocol, or data format.
- Microsoft Open Specifications: HRESULT values.
- Microsoft Open Specifications: Windows Client Certificate Enrollment.
- Microsoft: Certificate templates overview.
- Microsoft: certreq command.
Looking for a different code? Search another status or error code.