CERTSRV_E_SIGNATURE_POLICY_REQUIRED 0X80094809 Fix

Cause 1: The CA policy module requires signature policy — and your request doesn't have it

This is the most common cause. You're submitting a certificate request to a Windows Server Certificate Authority (CA) running on Windows Server 2012 R2, 2016, 2019, or 2022, and the CA's policy module has been set to require signature policy in the certificate request. The CA is basically saying: "Hey, your request didn't include any info about what signing policy you want me to use, so I'm rejecting it."

You'll see this error in the CA's event log or as a failed enrollment in the Certificate Services MMC snap-in. The exact text is:

The request is missing required signature policy information. 0x80094809 (-2146875383)

The quick fix is to change the CA's policy module to not require signature policy. This is often the right call unless you've got a specific compliance requirement that mandates it.

1. Open the Certification Authority MMC (certsrv.msc) on your CA server.
2. Right-click the CA name and choose Properties.
3. Go to the Policy Module tab.
4. Click Properties to open the policy module settings.
5. Look for a setting called "Require signature policy in certificate requests". It's usually one of the default policies. Uncheck that box.
6. Click OK twice to close the dialogs. After you click Apply, you should see the policy module configuration update immediately.
7. Restart the Certificate Services service: open Command Prompt as admin and run net stop certsvc && net start certsvc.

After the restart, try submitting your certificate request again. If you still get the error, move on to Cause 2.

Real-world trigger: I've seen this happen when an admin upgrades from Windows Server 2012 R2 to 2019 and the CA policy module gets reset to default settings. The upgrade process sometimes re-enables signature policy requirements that were previously turned off.

Cause 2: The PKCS10 request is missing the signature policy attribute

Let's say you can't or won't change the CA policy module — maybe your security team mandates signature policy enforcement. In that case, you need to include the SignaturePolicy attribute in your PKCS10 certificate request.

This happens most often when you're using certreq.exe with an INF file, or when a third-party application generates a certificate request that doesn't include the required OID for signature policy. The CA expects a specific attribute: usually 1.3.6.1.4.1.311.21.34 for the signature policy OID.

The fix is to manually add the signature policy attribute to your request INF file or script.

1. Open Notepad as admin and create a new INF file for your request. Here's a working example:

[NewRequest]
Subject = "CN=myserver.contoso.com"
KeySpec = 1
KeyLength = 2048
Exportable = TRUE
MachineKeySet = TRUE
RequestType = PKCS10
HashAlgorithm = SHA256

[Attributes]
SignaturePolicy = 1.3.6.1.4.1.311.21.34

2. Save the file as request.inf.
3. Open Command Prompt as admin and run this command to generate the request:

certreq -new request.inf request.req

After you run that, you'll get a file called request.req. Submit it to the CA using:

certreq -submit -config "CAServer\CA Name" request.req cert.cer

Replace CAServer and CA Name with your actual CA server and CA name. If the request goes through, you're done. If you still get 0x80094809, double-check that the SignaturePolicy attribute value is exactly 1.3.6.1.4.1.311.21.34. I've seen people type it wrong — it's case-sensitive and the dots matter.

Real-world trigger: I worked with a developer who wrote a custom app that used the Windows Certificate Enrollment API. Their C# code didn't set the signature policy attribute. Once we added the OID to the request object, the error vanished.

Cause 3: The CA template has signature policy enforcement enabled and it's not in the request

Sometimes the issue isn't the global CA policy module — it's the specific certificate template you're using. The template itself might require signature policy. This is less common but I've seen it with custom templates that were copied from the built-in ones.

Here's how to check and fix it:

1. Open the Certificate Templates MMC (certtmpl.msc) on your CA server.
2. Find the template you're trying to enroll against. Right-click it and choose Properties.
3. Go to the Extensions tab.
4. Look for the Signature Policy extension. If it's listed, click it and click Edit.
5. You'll see a list of policies. If it says "Require signature policy" or something similar, remove that requirement by unchecking the box or deleting the policy entry.
6. Click OK all the way out.
7. You need to update the template on the CA. In the Certification Authority MMC, right-click Certificate Templates under your CA, choose New > Certificate Template to Issue, and select the modified template. This will re-issue it with the new settings.
8. Restart the Certificate Services service again: net stop certsvc && net start certsvc.

After the restart, try submitting your request again. If you're still hitting the error, go back and check Cause 1 and Cause 2 — it's probably one of those.

Real-world trigger: I once had a sysadmin who copied the Web Server template and added a signature policy extension manually, thinking it would enforce compliance. It didn't — it just broke all enrollments against that template until we removed the requirement.

Quick-reference summary table