Fix CERTSRV_E_BAD_RENEWAL_SUBJECT 0x80094806

This error means the certificate renewal request has a subject that doesn't match the original. You need to use the same subject or enroll as the original requester.

Quick answer

Re-run the renewal request with the –enroll flag using the same user account that originally enrolled the certificate, or manually set the subject to match the original certificate.

What's actually happening here

This error pops up when you try to renew a certificate and the subject in the renewal request doesn't match the subject in the original certificate. The Certification Authority (CA) sees this as a mismatch and refuses to issue the new cert.

The exact scenario: you're using a Windows Server 2019 or 2022 CA, and you've got a user or computer certificate that's about to expire. You run certreq –submit with a renewal request, but you changed the subject line accidentally (maybe you added a space or used a different UPN), or you're running the command under a different user account than the one that originally enrolled. The CA checks that the requester matches the subject in the original request – it's a security measure to stop someone from renewing a certificate for a different user.

The error code 0x80094806 maps directly to CERTSRV_E_BAD_RENEWAL_SUBJECT. It's not a permissions issue, it's a subject mismatch. The CA is saying "hey, you're asking for a cert for Bob, but the original cert was for Alice – that's not allowed."

How to fix it

Check the original certificate subject
Open the old certificate in the Certificates MMC snap-in (run certlm.msc for computer or certmgr.msc for user). Go to Details > Subject. Copy the exact subject string, including commas and spaces.
Export the original enrollment request
If you have the original .req file, that's best. If not, create a new request with the exact same subject. Use certreq –new with a properly edited INF file.
Ensure the subject matches exactly
In your INF file, the Subject line must be byte-for-byte identical to the original. Example:
```
[NewRequest]
Subject = "CN=server01.contoso.com, OU=IT, DC=contoso, DC=com"
```
One extra space after the comma will break it.
Enroll under the original account
If the original certificate was enrolled by a specific user or computer account, you must run the renewal under that same account. For computer certs, run as SYSTEM (use psexec –i –s cmd). For user certs, log in as that user.
Use the –enroll flag
Submit the renewal with: certreq –submit –config <CAhostname>\<CAName> request.req. The CA will match the subject from the request against the original.

Alternative fix if the main one fails

If you can't match the subject or the original account is gone, you can't renew. You must enroll a brand new certificate. Request a new certificate from scratch using certreq –new with a new INF file. The subject can be whatever you want, but the CA will treat it as a fresh enrollment, not a renewal. This means you might need to re-export the private key and re-install the cert on all systems.

Prevention tip

Always generate renewal requests from the same computer and user account that did the original enrollment. Document the exact subject string in your PKI documentation. Use Certificate Templates with the "Supply in the request" option set to "Allow". This lets you specify the subject during enrollment without getting this error, because the template doesn't enforce a subject match.