Certificate error 0x80094001 (CERTSRV_E_BAD_REQUESTSUBJECT)

An internal CA rejects a request with 0x80094001. The usual cause is a country name written out in full instead of its two-letter ISO 3166 code.

Contents

Requesting a certificate from an internal Microsoft CA sometimes fails with error 0x80094001. The message mentions the subject name but does not say what is wrong with it.

The error

Certificate Request Denied
Your certificate request was denied.
Your Request Id is 0. The disposition message is "Error Parsing Request The request subject name is invalid or too long. 0x80094001 (-2146877439 CERTSRV_E_BAD_REQUESTSUBJECT)".
Contact your administrator for further information.

The cause

In most cases the country (C) field of the subject contains the full country name, such as Switzerland, instead of the two-letter code from ISO 3166-1 alpha-2, such as CH. The CA rejects the whole subject as invalid.

Fix the country field and submit the request again. The official list of codes is on the ISO website, and Wikipedia has a convenient table.

If the country code is not the problem

The same error appears for other problems with the subject, for example a field that is longer than the CA allows. Check each field of the subject against the CA’s requirements, and ask the CA’s administrators if the request still fails.

Join the discussion

Comments are hosted on comments.vciso.ch, a server I run myself. Nothing is loaded from it until you press the button below. Loading comments connects your browser to that server, and signing in with GitHub sets a cookie there. See the privacy page for details.

Type to search.

↑ ↓ to move, Enter to open, Esc to close