What does HRESULT 0x80094816 (CERTSRV_E_RENEWAL_BAD_PUBLIC_KEY) mean?

 
Previous Next
CERTSRV_E_TOO_MANY_SIGNATURES CERTSRV_E_INVALID_EK

CERTSRV_E_RENEWAL_BAD_PUBLIC_KEY

CERTSRV_E_RENEWAL_BAD_PUBLIC_KEY identifies a failure in same-key renewal enforcement. The template requires renewal with the original public key, but the renewal request carries a different key pair. Diagnose same-key renewal enforcement at the first component that returned the value, not the last user-interface layer that displayed it; later cleanup and fallback attempts can produce different secondary errors.

Where the status is selected

The certification authority is evaluating the request against a published certificate template. Capture the template OID, display name, major and minor version, CA template publication state, key and subject settings, validity and renewal periods, and any authorized-signature requirements.

Evidence that changes the diagnosis

  • Template OID and version actually referenced by the request
    Compare the SubjectPublicKeyInfo of the old certificate and the submitted request.
    Links the status to the exact template or CA transaction.
  • CA configuration, published-template set, and directory replication view
    Confirm that the client initialized a renewal from the intended certificate rather than creating a new request.
    Preserves directory, request, and policy data evaluated by the CA.
  • Encoded request attributes, public-key properties, renewal state, and signer count
    If policy allows key rollover, use a template without same-key renewal enforcement.
    In the path, avoids treating a new enrollment as proof that the original request was fixed.

What to include in an escalation package

CA decisions depend on directory and transaction state at a particular moment. Correlate template modification and publication, Active Directory replication, request submission, request ID assignment, policy-module evaluation, disposition changes, and any client continuation., this is especially important when a retry reaches a different domain controller or creates a new CA database row.

  • exported request and relevant attributes, template OID/version, CA configuration, and original request ID.
  • CA operational events and request disposition history from the same transaction.
  • In the path, directory evidence showing the template and requester attributes as visible to the CA at evaluation time.

A controlled way to reproduce it

In the path, submit a nonproduction request built directly from the same template with one known compliant key and identity. Then change only the policy dimension named by the status in a same-key renewal enforcement investigation. This avoids confusing template lookup, request construction, and CA issuance policy.

  1. Preserve the original input, identity, provider or protocol selection, and first return Value.
  2. Use one known-good control that changes only the suspected part of the same-key renewal enforcement path.
  3. reverse the comparison with known-good input on the failing layer where that can be done safely.
  4. Record where behavior first diverges in the same-key renewal enforcement path instead of judging only by the final application message.

Nearby results and misleading fixes

A valid new key can still be rejected because the policy tests continuity, not merely cryptographic strength. Issuing from another template can make enrollment succeed while producing a certificate with different EKUs, key policy, subject rules, or lifetime. Treat it as a comparison, not the repair.

For same-key renewal enforcement, keep the original request and response pair; regenerating a key or submitting a new request may succeed while bypassing the policy or transaction state that produced this HRESULT.

What counts as a real resolution

The CA must accept a request that still uses the intended template and security policy, and the resulting certificate must contain the expected identity, usages, key, and lifetime in a same-key renewal enforcement investigation. Keep a regression case that uses nonsecret identifiers and expected outcomes, including one negative control that must continue to fail.

Technical references

These sources define the HRESULT and the relevant same-key renewal enforcement interface, protocol, or data format.


Looking for a different code? Search another status or error code.