Renew Issuing CA Certificate via offline Root CA

0

I have an offline root CA and an enterprise issuing CA. I created a req from the issuing CA and issued a cert with it on the offline root CA. When I try to install the cert on the issuing CA with the Certification Authority snap in I get the following error:

Cannot verify certificate chain. Do you wish to ignore the error and continue? The signature of the certificate can not be verified. 0x80096004 (-214689244)

Any idea?

windows-server-2008
certificate
asked on Server Fault Apr 26, 2020 by Peter • edited Apr 26, 2020 by Hauke Laging

1 Answer

1

It looks like you didn't install the root certificate in the servers 'trusted root certification Authorities' store. When you try to import the signed certificate - it cannot verify the chain as trusted - and the import fails.

Open MMC - Add remove Snnapin - Certificates - Local Machine, and import the root certificate into the 'trusted root certification Authorities' store.

answered on Server Fault May 4, 2020 by CryptoDan

User contributions licensed under CC BY-SA 3.0