scep服务器返回了无效的响应,CA 认证 SCEP

最新推荐文章于 2025-12-04 11:33:53 发布

转载最新推荐文章于 2025-12-04 11:33:53 发布 · 562 阅读

文章标签：

#scep服务器返回了无效的响应

该博客讨论了证书申请过程中涉及的签名策略。当证书请求引用了一个msPKI-RA-Signature非零模板时，CA服务器必须确保用于签署请求的私钥符合msPKI-RA-Policies和msPKI-RA-Application-Policies属性的要求。如果这个属性的值非零且请求中没有额外的签名，CA应返回错误0x80094809。另外，如果证书请求的签名数量少于该属性定义的数量，CA也应返回错误0x8009480A。

你所遇到的无效响应，是这个吗？

CAs that receive a certificate request referring to a template where the msPKI-RA-Signature is nonzero MUST require that the private keys used to sign the request are associated with certificates that meet the requirements of the msPKI-RA-Policies and msPKI-RA-Application-Policies

attributes.

If the value of this property is non-zero and there are no (additional) signatures in the request, the CA SHOULD return a non-zero error. The error Should be

0x80094809 (CERTSRV_E_SIGNATURE_POLICY_REQUIRED).

If the number of signatures on the certificate request is less than the number defined by this property, the CA SHOULD return a non-zero error. The error SHOULD be

0x8009480A (CERTSRV_E_SIGNATURE_COUNT).