Certificate Request Processor: The request subject name is invalid or too long. 0x80094001

Question

_{Thursday, April 19, 2018 7:34 AM}

Hello All,

I am trying to install user base certificate on domain machine, however it's working without '-q' parameters and asking "More information is required to enroll for this certificate. Click here to configure settings." 

_________________________________________________________________

But when I am using '-q' , I am not able to provide CN=CNNAME into the command line parameters and it's giving me below error.

C:\Users\User1>Certreq -enroll -q "CertificateTemplete"

xxx.xxx.com\XXX Issuing CA XXX
    The certificate request could not be submitted to the certification authority.
    The RPC server is unavailable. 0x800706ba (WIN32: 1722 RPC_S_SERVER_UNAVAILABLE)
xxx.xxx.com\XXX Issuing CA YYY
    Error Constructing or Publishing Certificate
    The request subject name is invalid or too long. 0x80094001 (-2146877439 CERTSRV_E_BAD_REQUESTSUBJECT)
 The request ID is 202263.

Certificate Request Processor: The request subject name is invalid or too long. 0x80094001 (-2146877439 CERTSRV_E_BAD_REQUESTSUBJECT)

_______________________________________________________________________________________________

Thanks, dashrath Chate

All replies (3)

_{Friday, April 20, 2018 1:45 AM}

Hi DC Admin,

This error is generally because extensions in the CA cert or other CA certs in the chain limit the Enhanced Key Usage / Application Policies the CA is allowed to issue.

Did you specify an [EnhancedKeyUsageExtension] section in any of the CA's in the chain capolicy.inf files?

Also could you try copying the "User - Signature Only" default template and then request a certificate using this template instead. (to rule out any issue with key archival)

Check this similar case for some ideas:

"Error Parsing Request The request subject name is invalid or too long" when trying to create a certificate from a CSR

https://social.technet.microsoft.com/Forums/ie/en-US/dc23cde8-089a-46ca-9238-0eb2fe29447f/error-parsing-request-the-request-subject-name-is-invalid-or-too-long-when-trying-to-create-a?forum=winserversecurity

Regards

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected].

_{Friday, April 20, 2018 1:47 AM}

Please note:

Don't leave any personal contact information here, it's a public forum, your substantial contact information can be viewed by anyone, which may lead to the expected security risk.

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected].

_{Monday, April 23, 2018 8:58 AM}

Thanks Teemo,

but this is not an issue with extensions in the CA cert in the chain limit the Enhanced Key Usage or Application Policies. Also I am not using any .inf file. 

My simple question is that, How to provide "More information is required to enroll for this certificate. Click here to configure settings." via command utility.

Thanks, dashrath Chate