I'm Back! :) Again.
I have feeling it's going to be Mark Cooper who answers this one.
I've been fighting with a PKI project for about a month now and it's been extremely painful for ONE major factor; CORE!
I love optimizing but in this case it has been really, really painful. Such as this bug which I've seen reported online for a long time. (Thanks Mark)
Then I had to fix a mistake I made in my Offline-Root-CA which showed a wrong CDP location in my PKI from the issued Sub-CA.
I'm actually currently working on fixing this issue and the reason for this post.
1) I first tried to simply take the existing CSR, and re-issue it, no issues on the re-issue (lol). However attempting to install the new issued cert on the Sub CA resulted in the following:
CertUtil: -installcert command FAILED: 0x8007139f (WIN32: 5023 ERROR_INVALID_STATE)
CertUtil: The group or resource is not in the correct state to perform the requested operation.
At this point I had assumed it was due to the service being up and running, So from a remote mgmt machine via the CA snap-in MMC tool, shutdown the services, as well as from the Sub-CA ran "CertUtil -Shutdown"
*SIDE QUESTION* What exactly does "CertUtil -shutdown" do? Does it simply stop the cert services on the local machine, or all AD Cert services? How do you revert this command? I couldn't find a CertUtil -Start or any equivalent command.
Having failed here due to my ignorance, I decided to google in hopes of a solution. Sadly the best I could find was this.
First thing to note is Yet more bugs in the CA Snap-in Tool remotely, on top of the "Install CA Cert" literally not doing anything, once you install the cert via "CertUtil -installCert" The SubCA services come up fine up, but will be missing context menus, in this case "Renew CA Certificate".
So I decided to try the other suggested workaround "CertUtil RenewCert ReuseKeys", However they would receive an error as follows:
CertUtil: -renewCert command FAILED: 0x80070003 (WIN32: 3)
CertUtil: The system cannot find the path specified.
I however get the following error:
CertUtil: -renewCert command FAILED: 0x80092004 (-2146885628 Crypt_E_NOT_FOUND)CertUtil: Cannot find object or property.
I'm a bit stumped right now... How do I accomplish this task?