Using a different subordinate certificate authroity template when deploying a sub ca

I would like to extend the validity period of a subordinate CA. The default tamplate SubCA has a validiyt period of 5 years. I have duplicated this and extended the validity as required. When I install a subordinate I choose to generate a request file. This file defaults to using the SubCA template.

When I try to use certreq to submit it with a different certificate certificate template specified as a request attribute, or use certreq -policy to generate a new request file using an inf file with the new certificate template specified, I get the error - The request contains conflicting template information - Denied by policy module.


Thanks