Fixing CERTSRV_E_RENEWAL_BAD_PUBLIC_KEY (0x80094816)

Template Doesn't Allow Same Key Renewal

The most common reason I see this error — the certificate template used for the original cert doesn't have the right settings for renewal. You're sending a new key, but the template expects the old one, or vice versa.

Here's the deal: when you renew a certificate, the CA compares the public key in the renewal request to the one in the original cert. If they don't match, you get error 0x80094816. The culprit here is almost always the template's "Renew with same key" option.

Fix it:

1. Open the Certificate Templates snap-in (certtmpl.msc) on your CA.
2. Find the template your original cert used.
3. Right-click it and select Properties.
4. Go to the Request Handling tab.
5. Check the box for "Renew with same key". If it's already checked, uncheck it. Yes, you read that right — toggle it.
6. Click OK. Then go to the CA console, right-click Certificate Templates, choose New > Certificate Template to Issue, and add this template if it's not already there.
7. Reissue the renewal request.

This forces the CA to accept either a new or existing key. I've fixed dozens of renewals with this one toggle. Don't waste time on anything else first.

Key Archival Is Misconfigured

Second most common cause: you're trying to renew a certificate that was issued with key archival enabled, but the renewal request doesn't include the private key for archival. Or the reverse — the original had no archival, but your renewal request includes a key that triggers archival validation.

This bites you hard in environments using AD CS with key recovery agents. If the original cert's key was archived and your renewal request brings a fresh key, the CA rejects it because it can't match the archived material.

Fix it:

1. On the CA server, open the CA console (certsrv.msc).
2. Right-click the CA name, choose Properties.
3. Go to the Recovery Agents tab.
4. Check if any key recovery agents are defined. If yes, key archival was likely enabled.
5. Now check the template's Request Handling tab — look for the "Key archival" section. If it's set to "Allow key export" or "Archive subject's encryption private key," then archival is on.
6. If you're renewing, you must submit the renewal request with the same key as the original. Use a PFX export from the original cert's private key, or use the certreq command with the original key container.
7. Run this to submit with the original key:

   certreq -new -q -cert "path to original .cer" policy.inf request.req

   where policy.inf points to the original key container.

Skip trying to use MMC for renewal here — it'll generate a new key every time. Use certreq with the original key file.

Duplicate Enrollment or Stale CRL Check

Third scenario, rarer but I still see it: the client has multiple certificates with the same serial number but different keys. This happens when someone manually enrolls a cert, then tries to renew from a different machine or profile. The CA's database sees a mismatch because the renewal request's public key doesn't match the one it remembers for that serial number.

Another variant: the CA's CRL or certificate database has a stale entry for a previous renewal attempt. The CA rejects the new request because it sees an old key in its database.

Fix it:

1. On the problematic client, open certlm.msc (local machine) or certmgr.msc (current user).
2. Find the certificate you're trying to renew. Check its Details tab for the Serial number and Public key.
3. On the CA server, open the CA console, expand Issued Certificates, and find the matching certificate. Compare serial numbers and public key info. If they don't match, delete the duplicate from the client's store.
4. Clear the client's certificate request cache:

   certutil -delstore MY <serialnumber>

   Replace <serialnumber> with the old cert's serial (no spaces).
5. Restart the Certificate Services on the CA:

   net stop certsvc && net start certsvc

6. Try the renewal again. If it still fails, revoke the original cert on the CA and issue a brand new one using a different template name.

This is a last resort — revoking a working cert is painful. Only do it if the first two fixes didn't work.

Quick-Reference Summary