Fix CERTSRV_E_BAD_TEMPLATE_VERSION (0x80094807)

Quick Answer

If you're an admin who knows your way around a CA, the fix is to either upgrade your CA to a newer Windows Server version or reissue the certificate with an older template version that your CA supports. The error code 0x80094807 means your CA doesn't recognize the template version you're using.

Why This Happens

Certificate templates have version numbers baked into them. Windows Server 2003 templates are version 1, 2008/2008 R2 are version 2, and 2012 and later are version 3. When you try to enroll a certificate using a template that's newer than what your CA can process, you'll see CERTSRV_E_BAD_TEMPLATE_VERSION. I've seen this most often after someone copies a template from a newer CA to an older one, or when they upgrade a CA but the template schema doesn't match. It also pops up when you try to use a template with a newer schema version on a CA that hasn't been updated to support it.

Fix Steps

1. Check the CA's operating system and template schema version.
   On your CA server, open an elevated Command Prompt and run:

   certutil -v -config <CA_NAME> -getreg ca\DSConfig

   Under TemplateSchemaVersion, you'll see a number. If it's lower than the template's version, that's your problem. For example, if your CA shows schema version 2 but the template is version 3, you're stuck until you upgrade.
2. Upgrade the CA to a newer Windows Server version.
   If your CA is running Windows Server 2008 R2 or earlier, the long-term fix is to upgrade to 2012 or later. Template version 3 was introduced in Server 2012. You can't just patch in support for it on older OSes. Plan an in-place upgrade or migrate to a new CA server. This is the cleanest solution.
3. If upgrading isn't possible right now, modify the template version.
   You can manually edit the template's AD object to lower its version number. This is hacky and I don't love it, but it works in a pinch. On a domain controller, open ADSI Edit and navigate to CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=yourdomain,DC=com. Find the template in question, right-click, select Properties, and locate the msPKI-Template-Schema-Version attribute. Change it to 2 if it's 3. Then on the CA, run certutil -setreg CA\DSConfig <version> and restart the CA service. Warning: This may break the template's features, and future updates might overwrite it. Use only as a temporary workaround.
4. Reissue the certificate with an older template.
   If you can't upgrade or edit, create a new template based on the version your CA supports. For example, duplicate the built-in Web Server template (version 2) and configure it with the same settings you need. Then re-request the certificate using that new template. You'll lose some newer features, but you'll get a working cert.

If the Main Fix Fails

Sometimes the issue isn't the template schema but the template version number in the request itself. If you're using a client that constructs certificates manually (like some network devices or custom scripts), make sure they're not specifying a version that doesn't exist. Check the request syntax and compare it to what your CA expects. Also verify that the CA's TemplateSchemaVersion registry key hasn't been changed incorrectly. Reboot the CA after any registry changes—the service doesn't always pick them up right away.

Prevention Tips

The best way to avoid this is to keep your CA operating system updated. Don't run a CA on an unsupported OS. Also, be careful when copying templates between CAs—always check that the template schema versions are compatible. If you're migrating to a newer CA, use the built-in certutil -getreg and certutil -setreg to back up and restore the CA configuration, rather than manually copying template objects. That way the versions stay in sync. And before you enroll a new certificate type, run a quick test with a throwaway template to catch version mismatches early.