Skip to main content

Why do I get “Invalid CSR” errors when trying to renew my SSL certificate using IIS 7?

User-added image

When using the Renew option to generate your Certificate Signing Request (CSR) in IIS 7, you may end up with a CSR that is much longer than usual. This CSR will show up as invalid when you try to submit your online renewal. If you try to decode this CSR using any decoder, you will see that the CSR cannot be decoded.

You will see a CSR that looks something like this:

-----BEGIN NEW CERTIFICATE REQUEST----- MIIPjQYJKoZIhvcNAQcCoIIPfjCCD3oCAQExCzAJBgUrDgMCGgUAMIIIhgYJKoZI hvcNAQcBoIIIdwSCCHMwgghvMIIH2AIBADBiMQswCQYDVQQGEwJDQTEQMA4GA1UE CAwHT250YXJpbzEPMA0GA1UEBwwGS2FuYXRhMRUwEwYDVQQKDAxFbnRydXN0I Yy4xGTAXBgNVBAMMEG1haWwuZW50cnVzdC5jb20wgZ8wDQYJKoZIhvcNAQEBBQAD gY0AMIGJAoGBAMOdGrPbmYVWuljsey/javH8/CgP7iJPq8Th8tL0fjPFGW908MEz c7YGZiILfQ/R4nfDnqY/gWKDcfN/r6iWQ9P8WrW6VvTP0nD684peAjLSBx+Lmcad PRKkhgYMwnw0iovjwLtr5YVY1EtxQvLCk8PhadhOOY3JSrWsKWEbo5dLAgMBAAGg ggbLMBoGCisGAQQBgjcNAgMxDBYKNi4xLjc2MDAuMjBZBgkrBgEEAYI3FRQxTDBK AgEFDB5FeGNoYW5nZTIwMDcuZW50cnVzdGxhYi5pbnNpZGUMGEVOVFJVU1RMQUJc QWRtaW5pc3RyYXRvcgwLSW5ldE1nci5leGUwZgYKKwYBBAGCNw0CAjFYMFYCAQIe TgBNAGkAYwByAG8AcwBvAGYAdAAgAFMAdAByAG8AbgBnACAAQwByAHkAcAB0AG8A ZwByAGEAcABoAGkAYwAgAFAAcgBvAHYAaQBkAGUAcgMBADCB4AYJKoZIhvcNAQkO MYHSMIHPMAsGA1UdDwQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUH AwIwQAYDVR0gBDkwNzA1BgkqhkiG9n0HSwIwKDAmBggrBgEFBQcCARYaaHR0cDov L3d3dy5lbnRydXN0Lm5ldC9ycGEwNQYDVR0RBC4wLIIQbWFpbC5lbnRydXN0LmNv bYILZW50cnVzdC5uZXSCC2VudHJ1c3QuY29tMAkGA1UdEwQCMAAwHQYDVR0OBBYE FL7iDZWIzfb8ijZ/IeIiLOnN+cOZMIIFBQYJKwYBBAGCNw0BMYIE9jCCBPIwggPa oAMCAQICBEwYP9QwDQYJKoZIhvcNAQEFBQAwgbExCzAJBgNVBAYTAlVTMRYwFAYD VQQKEw1FbnRydXN0LCBJbmMuMTkwNwYDVQQLEzB3d3cuZW50cnVzdC5uZXQvcnBh IGlzIGluY29ycG9yYXRlZCBieSByZWZlcmVuY2UxHzAdBgNVBAsTFihjKSAyMDA5 IEVudHJ1c3QsIEluYy4xLjAsBgNVBAMTJUVudHJ1c3QgQ2VydGlmaWNhdGlvbiBB dXRob3JpdHkgLSBMMUMwHhcNMTAwNjE3MTg1ODQ0WhcNMTEwNjE3MTkyODQzWjBi MQswCQYDVQQGEwJDQTEQMA4GA1UECBMHT250YXJpbzEPMA0GA1UEBxMGS2FuYXRh MRUwEwYDVQQKEwxFbnRydXN0IEluYy4xGTAXBgNVBAMTEG1haWwuZW50cnVzdC5j b20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCdYA6yQsLXLzUlWilD V+nF6rcGEev1CTG+HTNf9O9LBCFVUiV/ebZn8BUbFPyi6bO7XgoOjyZKJKhYQwID jU7pPwZF+AKqmXJ05klkjPFxwZYTIhXxIcAc+0WyTVSP4QB+OmaIQ4cQe0/QNR8g mjmh9SvVHsXYcrb91ibeKTglUm+ACSyJ4C8Vp8Sy1Fx6vDwW1pPNB6RJeM0qiuTp ygzBpswuFIvyjo3E1Zb10eQSXfzLJ1+hDTRHIw6E0rXAimRYbp2MNJcBy8qcSX7Y iU/BJWXAP4piH7w3Gm0rxc/+qwbWpxgFkizBUjvE19j99xQNd/ZtZLWCTwM6VCTL XE5PAgMBAAGjggFeMIIBWjALBgNVHQ8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUH AwEGCCsGAQUFBwMCMDMGA1UdHwQsMCowKKAmoCSGImh0dHA6Ly9jcmwuZW50cnVz dC5uZXQvbGV2ZWwxYy5jcmwwMwYIKwYBBQUHAQEEJzAlMCMGCCsGAQUFBzABhhdo dHRwOi8vb2NzcC5lbnRydXN0Lm5ldDBABgNVHSAEOTA3MDUGCSqGSIb2fQdLAjAo MCYGCCsGAQUFBwIBFhpodHRwOi8vd3d3LmVudHJ1c3QubmV0L3JwYTA1BgNVHREE LjAsghBtYWlsLmVudHJ1c3QuY29tggtlbnRydXN0Lm5ldIILZW50cnVzdC5jb20w HwYDVR0jBBgwFoAUHvGriQb4SQ8BM3fuFHruGXyTKE0wHQYDVR0OBBYEFKP1779V roCggpbgIqyMUlFtbNC7MAkGA1UdEwQCMAAwDQYJKoZIhvcNAQEFBQADggEBAJSo kyYIYhT6Dho261Yq9/YK5bo2G/N4VAZHs4CwUHRAEu2OLsfLJWm85fFdS1U6jkVb bAi6zv/Jq0cskplIyPt8CvRPFlGgFhk6wA6I+RWfklkd7NUT7Dp4E0AkryBNeqqx r/C2oqC4KJ5KwH5n/Yv5p1iRjJQ73XIIDvqRaZbLhgBVOC99KRZ5m3JcHAXpVCnA lmOezOFdtgmYevKIgL2JhckVi04P02iCkTslumCXgad9gmbBkE6vKtSSCT81pNJt 1Aoezb40BgufoPA46WJEfonowNNiOX7RJyCtpcJ/2NPfjb5xz6BlGGZOCgF7g9QG aZwUatiesrIWsHJlMXYwDQYJKoZIhvcNAQEFBQADgYEAwpOML4ev1Bn9krbAtb4f kYSDo8udaRxcgxHxy/ErCCMAEv3oEzjQ2vdyPy/FiZAcfF72QA/eMB0HureWvkqy w89HVpo5E9QDM1SSyr77WrHlROJPqrmxyjXjMfegi4FuXufc+kqbcy4z797Cd1Lg JrN5W77MQHMgfQ3uFnFKt+agggT2MIIE8jCCA9qgAwIBAgIETBg/1DANBgkqhkiG 9w0BAQUFADCBsTELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUVudHJ1c3QsIEluYy4x OTA3BgNVBAsTMHd3dy5lbnRydXN0Lm5ldC9ycGEgaXMgaW5jb3Jwb3JhdGVkIGJ5 IHJlZmVyZW5jZTEfMB0GA1UECxMWKGMpIDIwMDkgRW50cnVzdCwgSW5jLjEuMCwG A1UEAxMlRW50cnVzdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEwxQzAeFw0x MDA2MTcxODU4NDRaFw0xMTA2MTcxOTI4NDNaMGIxCzAJBgNVBAYTAkNBMRAwDgYD VQQIEwdPbnRhcmlvMQ8wDQYDVQQHEwZLYW5hdGExFTATBgNVBAoTDEVudHJ1c3Qg SW5jLjEZMBcGA1UEAxMQbWFpbC5lbnRydXN0LmNvbTCCASIwDQYJKoZIhvcNAQEB BQADggEPADCCAQoCggEBAJ1gDrJCwtcvNSVaKUNX6cXqtwYR6/UJMb4dM1/070sE IVVSJX95tmfwFRsU/KLps7teCg6PJkokqFhDAgONTuk/BkX4AqqZcnTmSWSM8XHB lhMiFfEhwBz7RbJNVI/hAH46ZohDhxB7T9A1HyCaOaH1K9Uexdhytv3WJt4pOCVS b4AJLIngLxWnxLLUXHq8PBbWk80HpEl4zSqK5OnKDMGmzC4Ui/KOjcTVlvXR5BJd /MsnX6ENNEcjDoTStcCKZFhunYw0lwHLypxJftiJT8ElZcA/imIfvDcabSvFz/6r BtanGAWSLMFSO8TX2P33FA139m1ktYJPAzpUJMtcTk8CAwEAAaOCAV4wggFaMAsG A1UdDwQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMwYDVR0f BCwwKjAooCagJIYiaHR0cDovL2NybC5lbnRydXN0Lm5ldC9sZXZlbDFjLmNybDAz BggrBgEFBQcBAQQnMCUwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLmVudHJ1c3Qu bmV0MEAGA1UdIAQ5MDcwNQYJKoZIhvZ9B0sCMCgwJgYIKwYBBQUHAgEWGmh0dHA6 Ly93d3cuZW50cnVzdC5uZXQvcnBhMDUGA1UdEQQuMCyCEG1haWwuZW50cnVzdC5j b22CC2VudHJ1c3QubmV0ggtlbnRydXN0LmNvbTAfBgNVHSMEGDAWgBQe8auJBvhJ DwEzd+4Ueu4ZfJMoTTAdBgNVHQ4EFgQUo/Xvv1WugKCCluAirIxSUW1s0LswCQYD VR0TBAIwADANBgkqhkiG9w0BAQUFAAOCAQEAlKiTJghiFPoOGjbrVir39grlujYb 83hUBkezgLBQdEAS7Y4ux8slabzl8V1LVTqORVtsCLrO/8mrRyySmUjI+3wK9E8W UaAWGTrADoj5FZ+SWR3s1RPsOngTQCSvIE16qrGv8LaioLgonkrAfmf9i/mnWJGM lDvdcggO+pFplsuGAFU4L30pFnmbclwcBelUKcCWY57M4V22CZh68oiAvYmFyRWL Tg/TaIKROyW6YJeBp32CZsGQTq8q1JIJPzWk0m3UCh7NvjQGC5+g8DjpYkR+iejA 02I5ftEnIK2lwn/Y09+NvnHPoGUYZk4KAXuD1AZpnBRq2J6yshawcmUxdjGCAeIw ggHeAgEBMIG6MIGxMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNRW50cnVzdCwgSW5j LjE5MDcGA1UECxMwd3d3LmVudHJ1c3QubmV0L3JwYSBpcyBpbmNvcnBvcmF0ZWQg YnkgcmVmZXJlbmNlMR8wHQYDVQQLExYoYykgMjAwOSBFbnRydXN0LCBJbmMuMS4w LAYDVQQDEyVFbnRydXN0IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gTDFDAgRM GD/UMAkGBSsOAwIaBQAwDQYJKoZIhvcNAQEBBQAEggEAhXypMg7+nu0HYjkoioje qsCeY96AlL4I9cBDLhniUQV4oLzV3QL+pVr81jqyE4uBEUH2w4TnbzIpw063/3HB pmtJ3Ufc2YTXA73Yw78mKq1otDzC1w3cTkW+oIFulbi5sMwJfP7uop4H8+oxAVok xQsJ9ldPp1S6wPUmKxXSiLPTo+aO8Gs/4qNgpHMYtSj3VkkiU7QcXKEo91y+vneX ifL3XyRx4Dh4oKIYqOClrUDH++aGYs2734CpRwjjr1BZ25YuZDfFboTPWF4Eeqsl xwJzsFtKMQHtMGccr+WXaafqQ8BvCI15x7SCsn/ZVreQ6yXRh+FCsD+E1ykETfGB 5Q== -----END NEW CERTIFICATE REQUEST----- As a work around, you can use the Create Certificate Request option instead of Renew . Fill out all of the required fields in the CSR creation wizard. The difference between using Renew instead of Create Certificate Request is that the Renew option does not prompt you to fill out the fields for your CSR, as it will use the same fields as your previous certificate.

If you have any questions or concerns please contact the Entrust Certificate Services Support department for further assistance:

Hours of Operation:
Sunday 8:00 PM ET to Friday 8:00 PM ET
North America (toll free): 1-866-267-9297
Outside North America: 1-613-270-2680 (or see the list below)
NOTE: It is very important that international callers dial the UITF format exactly as indicated. Do not dial an extra "1" before the "800" or your call will not be accepted as an UITF toll free call.

Country Number
Australia 0011 - 800-3687-7863
1-800-767-513
Austria 00 - 800-3687-7863
Belgium 00 - 800-3687-7863
Denmark 00 - 800-3687-7863
Finland 990 - 800-3687-7863 (Telecom Finland)
00 - 800-3687-7863 (Finnet)
France 00 - 800-3687-7863
Germany 00 - 800-3687-7863
Hong Kong 001 - 800-3687-7863 (Voice)
002 - 800-3687-7863 (Fax)
Ireland 00 - 800-3687-7863
Israel 014 - 800-3687-7863
Italy 00 - 800-3687-7863
Japan 001 - 800-3687-7863 (KDD)
004 - 800-3687-7863 (ITJ)
0061 - 800-3687-7863 (IDC)
Korea 001 - 800-3687-7863 (Korea Telecom)
002 - 800-3687-7863 (Dacom)
Malaysia 00 - 800-3687-7863
Netherlands 00 - 800-3687-7863
New Zealand 00 - 800-3687-7863
0800-4413101
Norway 00 - 800-3687-7863
Singapore 001 - 800-3687-7863
Spain 00 - 800-3687-7863
Sweden 00 - 800-3687-7863 (Telia)
00 - 800-3687-7863 (Tele2)
Switzerland 00 - 800-3687-7863
Taiwan 00 - 800-3687-7863
United Kingdom 00 - 800-3687-7863
0800 121 6078
+44 (0) 118 953 3088