Unable to install newly issued not-yet-valid certificate on MSIE 7.0 for Microsoft Vista
Originally Published: 2008-02-12
Article Number
Applies To
RSA Registration Manager
RSA Certificate Manager OneStep
Microsoft Windows Internet Explorer 7.0
Microsoft Windows Vista
Microsoft Windows Internet Explorer (MSIE) 7.0 on Microsoft Windows Vista has been qualified for digital certificate enrollment with RSA Certificate Manager, Registration Manager, and OneStep.
Issue
MSIE 7.0 on Microsoft Windows Vista does not allow installation of newly issued certificates that are not yet valid. This can happen when (1) certificates are generated immediately after, or soon after, submitting a request to RSA Certificate Manager (possibly through any of the available mechanisms to automatically generate certificates, such as OneStep or auto-vetting templates), and (2) the system time on Microsoft Vista is a few minutes or even a few seconds behind the RSA Certificate Manager system time.
0x800b0101 (-2146762495)
Cause
Resolution
To allow installation of newly issued certificates on Vista when system time on Vista might be behind the RSA Certificate Manager system time, apply Microsoft recommended fix (either hotfix KB945121 http://support.microsoft.com/kb/945121 or a more recent fix or service pack) on Vista, AND update all calls to InstallResponse method in RSA Certificate Manager, RSA Registration Manager, and/or RSA OneStep enrollment pages to use AllowUntrustedRoot flag.
For example, take the following steps to fix the issue on RSA Certificate Manager for standard certificate enrollment and installation:
1. Inform your Vista users (perhaps on the enrollment page) to ensure that they have applied Microsoft recommended fix KB945121 (or a more recent fix or service pack for Vista that resolves the bug with InstallMethod) prior to making a certificate request and that otherwise they would not be able to install new certificates.
2. Update all InstallResponse(0, ...) calls to InstallResponse(4, ...) in RSA Certificate Manager enrollment pages. There are two places in <RCM-install-dir>\WebServer\enroll-server\icontrol.vbs file where InstallResponse is being called.
Note that using the flag AllowUntrustedRoot (value 0x4) in InstallResponse method also allows installation of new certificates without first trusting the root CA (which is expected when using the flag AllowUntrustedRoot), though the root CA is installed under 'Intermediate Certification Authorities' store rather than 'Trusted Root Certification Authorities'.
RSA has reviewed the changes and fixes made by Microsoft in CertEnroll interface for Vista and included a fix in RSA Certificate Manager, RSA Registration Manager, and RSA OneStep 6.7 build 422 and later versions.
Notes
CERTMGR-3312
Related Articles
How can I tell what version of onestep.exe I have? Number of Views RSA Identity Governance & Lifecycle Identity Data Collection is failing due to ORA-00904: CUS_ATTR_USER_CAS_XX invalid ide… Number of Views Connecting to or querying the database using pgSQL in RSA Authentication Manager 8.x Number of Views Do TCP Agent using API ver. 8.5 & 8.6 need a new sdconf.rec file after a new Primary is promoted? Number of Views Reporting Engine service is not running due to reportstatusmanager.h2.db corrupt Number of Views
Trending Articles
RSA MFA Agent 2.3.6 for Microsoft Windows Installation and Administration Guide RSA Authentication Manager 8.9 Release Notes (January 2026) How to install the jTDS JDBC driver on WildFly for use with Data Collections in RSA Identity Governance & Lifecycle RSA Authentication Manager 8.8 Setup and Configuration Guide Artifacts to gather in RSA Identity Governance & Lifecycle
Don't see what you're looking for?
