| Previous | Next |
| CERTSRV_E_TOO_MANY_SIGNATURES | CERTSRV_E_INVALID_EK |
CERTSRV_E_RENEWAL_BAD_PUBLIC_KEY
CERTSRV_E_RENEWAL_BAD_PUBLIC_KEY identifies a failure in same-key renewal enforcement. The template requires renewal with the original public key, but the renewal request carries a different key pair. Diagnose same-key renewal enforcement at the first component that returned the value, not the last user-interface layer that displayed it; later cleanup and fallback attempts can produce different secondary errors.
Where the status is selected
The certification authority is evaluating the request against a published certificate template. Capture the template OID, display name, major and minor version, CA template publication state, key and subject settings, validity and renewal periods, and any authorized-signature requirements.
Evidence that changes the diagnosis
- Template OID and version actually referenced by the request
Compare the SubjectPublicKeyInfo of the old certificate and the submitted request.
Links the status to the exact template or CA transaction. - CA configuration, published-template set, and directory replication view
Confirm that the client initialized a renewal from the intended certificate rather than creating a new request.
Preserves directory, request, and policy data evaluated by the CA. - Encoded request attributes, public-key properties, renewal state, and signer count
If policy allows key rollover, use a template without same-key renewal enforcement.
In the path, avoids treating a new enrollment as proof that the original request was fixed.
What to include in an escalation package
CA decisions depend on directory and transaction state at a particular moment. Correlate template modification and publication, Active Directory replication, request submission, request ID assignment, policy-module evaluation, disposition changes, and any client continuation., this is especially important when a retry reaches a different domain controller or creates a new CA database row.
- exported request and relevant attributes, template OID/version, CA configuration, and original request ID.
- CA operational events and request disposition history from the same transaction.
- In the path, directory evidence showing the template and requester attributes as visible to the CA at evaluation time.
A controlled way to reproduce it
In the path, submit a nonproduction request built directly from the same template with one known compliant key and identity. Then change only the policy dimension named by the status in a same-key renewal enforcement investigation. This avoids confusing template lookup, request construction, and CA issuance policy.
- Preserve the original input, identity, provider or protocol selection, and first return Value.
- Use one known-good control that changes only the suspected part of the same-key renewal enforcement path.
- reverse the comparison with known-good input on the failing layer where that can be done safely.
- Record where behavior first diverges in the same-key renewal enforcement path instead of judging only by the final application message.
Nearby results and misleading fixes
A valid new key can still be rejected because the policy tests continuity, not merely cryptographic strength. Issuing from another template can make enrollment succeed while producing a certificate with different EKUs, key policy, subject rules, or lifetime. Treat it as a comparison, not the repair.
For same-key renewal enforcement, keep the original request and response pair; regenerating a key or submitting a new request may succeed while bypassing the policy or transaction state that produced this HRESULT.
What counts as a real resolution
The CA must accept a request that still uses the intended template and security policy, and the resulting certificate must contain the expected identity, usages, key, and lifetime in a same-key renewal enforcement investigation. Keep a regression case that uses nonsecret identifiers and expected outcomes, including one negative control that must continue to fail.
Technical references
These sources define the HRESULT and the relevant same-key renewal enforcement interface, protocol, or data format.
- Microsoft Open Specifications: HRESULT values.
- Microsoft Open Specifications: Windows Client Certificate Enrollment.
- Microsoft: Certificate templates overview.
- Microsoft: certreq command.
Looking for a different code? Search another status or error code.