HRESULT 0x80094816 (CERTSRV_E_RENEWAL_BAD_PUBLIC

Status / error code:

Category:

Constant name:

Source:

Facility:

Operating System:

Description:

The certificate template requires renewal with the same public key, but the request uses a different public key.

Previous	Next
CERTSRV_E_TOO_MANY_SIGNATURES	CERTSRV_E_INVALID_EK

CERTSRV_E_RENEWAL_BAD_PUBLIC_KEY

CERTSRV_E_RENEWAL_BAD_PUBLIC_KEY identifies a failure in same-key renewal enforcement. The template requires renewal with the original public key, but the renewal request carries a different key pair. Diagnose same-key renewal enforcement at the first component that returned the value, not the last user-interface layer that displayed it; later cleanup and fallback attempts can produce different secondary errors.

Where the status is selected

For CERTSRV_E_RENEWAL_BAD_PUBLIC_KEY, the certification authority is evaluating the request against a published certificate template. Capture the template OID, display name, major and minor version, CA template publication state, key and subject settings, validity and renewal periods, and any authorized-signature requirements when CERTSRV_E_RENEWAL_BAD_PUBLIC_KEY is returned.

Evidence that changes the diagnosis

Template OID and version actually referenced by the request
Compare the SubjectPublicKeyInfo of the old certificate and the submitted request.
For CERTSRV_E_RENEWAL_BAD_PUBLIC_KEY, links the status to the exact template or CA transaction.
CA configuration, published-template set, and directory replication view
Confirm that the client initialized a renewal from the intended certificate rather than creating a new request.
Preserves directory, request, and policy data evaluated by the CA when CERTSRV_E_RENEWAL_BAD_PUBLIC_KEY is returned.
Encoded request attributes, public-key properties, renewal state, and signer count
If policy allows key rollover, use a template without same-key renewal enforcement.
In the CERTSRV_E_RENEWAL_BAD_PUBLIC_KEY path, avoids treating a new enrollment as proof that the original request was fixed.

What to include in an escalation package

For CERTSRV_E_RENEWAL_BAD_PUBLIC_KEY, CA decisions depend on directory and transaction state at a particular moment. For CERTSRV_E_RENEWAL_BAD_PUBLIC_KEY, correlate template modification and publication, Active Directory replication, request submission, request ID assignment, policy-module evaluation, disposition changes, and any client continuation. In the CERTSRV_E_RENEWAL_BAD_PUBLIC_KEY path, this is especially important when a retry reaches a different domain controller or creates a new CA database row.

For CERTSRV_E_RENEWAL_BAD_PUBLIC_KEY, exported request and relevant attributes, template OID/version, CA configuration, and original request ID.
CA operational events and request disposition history from the same transaction when CERTSRV_E_RENEWAL_BAD_PUBLIC_KEY is returned.
In the CERTSRV_E_RENEWAL_BAD_PUBLIC_KEY path, directory evidence showing the template and requester attributes as visible to the CA at evaluation time.

A controlled way to reproduce it

In the CERTSRV_E_RENEWAL_BAD_PUBLIC_KEY path, submit a nonproduction request built directly from the same template with one known compliant key and identity. Then change only the policy dimension named by the status in a same-key renewal enforcement investigation. For CERTSRV_E_RENEWAL_BAD_PUBLIC_KEY, this avoids confusing template lookup, request construction, and CA issuance policy.

Preserve the original input, identity, provider or protocol selection, and first return value for CERTSRV_E_RENEWAL_BAD_PUBLIC_KEY.
Use one known-good control that changes only the suspected part of the same-key renewal enforcement path.
For CERTSRV_E_RENEWAL_BAD_PUBLIC_KEY, reverse the comparison with known-good input on the failing layer where that can be done safely.
Record where behavior first diverges in the same-key renewal enforcement path instead of judging only by the final application message.

Nearby results and misleading fixes

A valid new key can still be rejected because the policy tests continuity, not merely cryptographic strength. For CERTSRV_E_RENEWAL_BAD_PUBLIC_KEY, issuing from another template can make enrollment succeed while producing a certificate with different EKUs, key policy, subject rules, or lifetime. Treat it as a comparison, not the repair when CERTSRV_E_RENEWAL_BAD_PUBLIC_KEY is returned.

For same-key renewal enforcement, keep the original request and response pair; regenerating a key or submitting a new request may succeed while bypassing the policy or transaction state that produced this HRESULT.

What counts as a real resolution

The CA must accept a request that still uses the intended template and security policy, and the resulting certificate must contain the expected identity, usages, key, and lifetime in a same-key renewal enforcement investigation. For CERTSRV_E_RENEWAL_BAD_PUBLIC_KEY, keep a regression case that uses nonsecret identifiers and expected outcomes, including one negative control that must continue to fail.

Technical references

For CERTSRV_E_RENEWAL_BAD_PUBLIC_KEY, these sources define the HRESULT and the relevant same-key renewal enforcement interface, protocol, or data format.

Looking for a different code? Search another status or error code.