What does HRESULT 0x8009481F (CERTSRV_E_REQUEST_PRECERTIFICATE_MISMATCH) mean?

CERTSRV_E_REQUEST_PRECERTIFICATE_MISMATCH

The important part of CERTSRV_E_REQUEST_PRECERTIFICATE_MISMATCH is its scope: certificate-transparency precertificate continuity. The final certificate request does not match the precertificate state previously created for the issuance transaction. Keep the hexadecimal value 0x8009481F with the returning API, because higher-level software may translate it into a message that loses this distinction.

Start with the returning API

This status belongs to a stateful CA transaction rather than a standalone certificate parse in a certificate-transparency precertificate continuity investigation. For CERTSRV_E_REQUEST_PRECERTIFICATE_MISMATCH, preserve the original request ID, disposition, request attributes, precertificate or challenge material, client response, and CA database record. A resubmission creates a new transaction and cannot explain the old one when CERTSRV_E_REQUEST_PRECERTIFICATE_MISMATCH is returned.

Diagnostic evidence matrix

1. 1. CA configuration and original request ID with disposition history
   Preserve both the precertificate and final request inputs, including extensions and public key.
2. 2. Encoded request, attributes, precertificate or server challenge, and client response
   Check whether policy modules or request-processing code changed SANs, extensions, validity, or key data between stages.
3. 3. Timestamps and identity linking every follow-up operation to the same CA database row
   Restart the transaction only after identifying the mutation; otherwise repeated precertificates may be logged unnecessarily.

For certificate-transparency precertificate continuity, these observations are deliberately nonsecret: identifiers, lengths, provider names, policy selections, and state transitions usually support comparison without recording private keys, passwords, PINs, or plaintext.

Build a timeline before changing state

CA decisions depend on directory and transaction state at a particular moment when CERTSRV_E_REQUEST_PRECERTIFICATE_MISMATCH is returned. For CERTSRV_E_REQUEST_PRECERTIFICATE_MISMATCH, correlate template modification and publication, Active Directory replication, request submission, request ID assignment, policy-module evaluation, disposition changes, and any client continuation. This is especially important when a retry reaches a different domain controller or creates a new CA database row in a certificate-transparency precertificate continuity investigation.

• For CERTSRV_E_REQUEST_PRECERTIFICATE_MISMATCH, exported request and relevant attributes, template OID/version, CA configuration, and original request ID.
• CA operational events and request disposition history from the same transaction when CERTSRV_E_REQUEST_PRECERTIFICATE_MISMATCH is returned.
• In the CERTSRV_E_REQUEST_PRECERTIFICATE_MISMATCH path, directory evidence showing the template and requester attributes as visible to the CA at evaluation time.

Minimal test sequence

Run one clean test transaction and record each state transition from submission through response in a certificate-transparency precertificate continuity investigation. For CERTSRV_E_REQUEST_PRECERTIFICATE_MISMATCH, compare where the failing transaction diverges, rather than copying attributes between unrelated request IDs.

1. Preserve the original input, identity, provider or protocol selection, and first return value for CERTSRV_E_REQUEST_PRECERTIFICATE_MISMATCH.
2. Use one known-good control that changes only the suspected part of the certificate-transparency precertificate continuity path.
3. For CERTSRV_E_REQUEST_PRECERTIFICATE_MISMATCH, reverse the comparison with known-good input on the failing layer where that can be done safely.
4. Record where behavior first diverges in the certificate-transparency precertificate continuity path instead of judging only by the final application message.

Boundaries of this HRESULT

The mismatch concerns continuity between two issuance stages, not ordinary chain validation of the resulting certificate. Deleting or resubmitting the request before exporting its CA database information loses the linkage needed to diagnose mismatch or lock state when CERTSRV_E_REQUEST_PRECERTIFICATE_MISMATCH is returned.

For certificate-transparency precertificate continuity, keep the original request and response pair; regenerating a key or submitting a new request may succeed while bypassing the policy or transaction state that produced this HRESULT.

Closure criteria

For CERTSRV_E_REQUEST_PRECERTIFICATE_MISMATCH, the same transaction must advance through its documented next state using matching request and response material; a newly issued certificate from a new request is not proof. For CERTSRV_E_REQUEST_PRECERTIFICATE_MISMATCH, keep a regression case that uses nonsecret identifiers and expected outcomes, including one negative control that must continue to fail.

Technical references

For CERTSRV_E_REQUEST_PRECERTIFICATE_MISMATCH, these sources define the HRESULT and the relevant certificate-transparency precertificate continuity interface, protocol, or data format.

• Microsoft Open Specifications: HRESULT values.
• Microsoft Open Specifications: Windows Client Certificate Enrollment.
• Microsoft: Certificate templates overview.
• Microsoft: certreq command.

Looking for a different code? Search another status or error code.