Unable to install newly issued not-yet-valid certificate on MSIE 7.0 for Microsoft Vista
Originally Published: 2008-02-12
Article Number
Applies To
RSA Registration Manager
RSA Certificate Manager OneStep
Microsoft Windows Internet Explorer 7.0
Microsoft Windows Vista
Microsoft Windows Internet Explorer (MSIE) 7.0 on Microsoft Windows Vista has been qualified for digital certificate enrollment with RSA Certificate Manager, Registration Manager, and OneStep.
Issue
MSIE 7.0 on Microsoft Windows Vista does not allow installation of newly issued certificates that are not yet valid. This can happen when (1) certificates are generated immediately after, or soon after, submitting a request to RSA Certificate Manager (possibly through any of the available mechanisms to automatically generate certificates, such as OneStep or auto-vetting templates), and (2) the system time on Microsoft Vista is a few minutes or even a few seconds behind the RSA Certificate Manager system time.
0x800b0101 (-2146762495)
Cause
Resolution
To allow installation of newly issued certificates on Vista when system time on Vista might be behind the RSA Certificate Manager system time, apply Microsoft recommended fix (either hotfix KB945121 http://support.microsoft.com/kb/945121 or a more recent fix or service pack) on Vista, AND update all calls to InstallResponse method in RSA Certificate Manager, RSA Registration Manager, and/or RSA OneStep enrollment pages to use AllowUntrustedRoot flag.
For example, take the following steps to fix the issue on RSA Certificate Manager for standard certificate enrollment and installation:
1. Inform your Vista users (perhaps on the enrollment page) to ensure that they have applied Microsoft recommended fix KB945121 (or a more recent fix or service pack for Vista that resolves the bug with InstallMethod) prior to making a certificate request and that otherwise they would not be able to install new certificates.
2. Update all InstallResponse(0, ...) calls to InstallResponse(4, ...) in RSA Certificate Manager enrollment pages. There are two places in <RCM-install-dir>\WebServer\enroll-server\icontrol.vbs file where InstallResponse is being called.
Note that using the flag AllowUntrustedRoot (value 0x4) in InstallResponse method also allows installation of new certificates without first trusting the root CA (which is expected when using the flag AllowUntrustedRoot), though the root CA is installed under 'Intermediate Certification Authorities' store rather than 'Trusted Root Certification Authorities'.
RSA has reviewed the changes and fixes made by Microsoft in CertEnroll interface for Vista and included a fix in RSA Certificate Manager, RSA Registration Manager, and RSA OneStep 6.7 build 422 and later versions.
Notes
CERTMGR-3312
Related Articles
Microsoft Exchange 2010 AFX Connector Enable-mailbox command fails with 'Value cannot be null' in RSA Identity Governance … Number of Views How to retrieve content files - Client Number of Views Error "Key negotiation exchange failed. Server response was CRED_MISMATCH" with RSA Authentication Agent SDK 8.6 for Java Number of Views RSA Authentication Manager SDK 8.5 (for Java) failed on startup with a "CRED_MISMATCH" error Number of Views Disconnect or Delete an Identity Router Number of Views
Trending Articles
Downloading RSA Authentication Manager license files or RSA Software token seed records RSA MFA Agent 2.3.6 for Microsoft Windows Installation and Administration Guide Quick Setup Guide - Passwordless Authentication in Windows MFA Agent for Active Directory Mandatory Certificate Upgrade Required by 6th October 2025 for RSA MFA Agent for PAM, RSA MFA Agent for Apache, and Third … RSA Authentication Manager 8.9 Release Notes (January 2026)
Don't see what you're looking for?
