Fix CERTSRV_E_SIGNATURE_COUNT (0X8009480A) Error

The 30-Second Fix: Restart the Certificate Authority Service

This sounds too simple, but I've seen it work more times than you'd think. The CA service sometimes holds onto a bad state and just needs a kick.

1. Open Services (press Windows key + R, type services.msc, hit Enter).
2. Find Active Directory Certificate Services in the list.
3. Right-click it and pick Restart.
4. Wait 10 seconds, then try your certificate request again.

Did that fix it? Great — you're done. If not, move to the next step.

The 5-Minute Fix: Re-Request Using the Right Template

The error 0x8009480A often happens because you're using the wrong certificate template. Some templates require multiple signatures — like a subordinate CA cert that needs signatures from the root CA and an intermediate CA. If you pick the wrong template, you'll get this error.

1. Open the Certification Authority snap-in (type certsrv.msc in Run).
2. Right-click Certificate Templates and pick Manage.
3. Look at the template you're requesting. Check its properties.
4. For a subordinate CA, you want the template named Subordinate Certification Authority — not just any CA template.
5. If you need a simple computer or user cert, pick Workstation Authentication or User instead.
6. Delete your old pending request. Then submit a new one with the correct template.

After re-submitting, check the pending requests folder. You should see the request show up without the error.

Still stuck? Try this common fix for the Subordinate CA template

Sometimes the issue is that the template itself isn't configured to accept multiple signatures. Here's the quick check:

1. In the Certificate Templates console, right-click Subordinate Certification Authority and pick Properties.
2. Go to the Issuance Requirements tab.
3. Under Require the following for enrollment, make sure CA certificate manager approval is checked if you're using an enterprise CA. If not, the CA might reject the signature count.
4. Click OK, then re-request.

The 15-Minute Fix: Check and Fix the CA Certificate Chain

This error can also happen if your certificate authority doesn't trust the root cert that's supposed to sign the request. I've seen this a lot when migrating a CA to a new server.

Step 1: Verify the root CA is trusted

1. Open Certification Authority snap-in.
2. Right-click your CA name and pick Properties.
3. Go to the General tab. Look at the CA certificate line. It should say something like "Installed."
4. If it says Not installed or Expired, you have a chain problem.

Step 2: Reinstall the CA certificate (if needed)

1. On the CA server, open a Command Prompt as Administrator.
2. Type certutil -renew and press Enter. This renews the CA cert and fixes chain issues.
3. Wait 30 seconds, then type certutil -pulse. This forces the CA to check for updates.
4. Restart the Active Directory Certificate Services service again.
5. Try submitting your certificate request one more time.

Step 3: Manually add the missing intermediate certs (if renew didn't help)

Sometimes the chain is broken because an intermediate CA cert is missing from the trusted store. You'll need to export it from the root CA and import it here.

1. On the root CA server, export the root CA certificate (without private key) as a .cer file.
2. Copy that file to the subordinate CA server.
3. Open Certificates snap-in for the Local Machine.
4. Go to Trusted Root Certification Authorities > Certificates.
5. Right-click, pick All Tasks > Import, and import that .cer file.
6. Repeat the same import under Intermediate Certification Authorities > Certificates.
7. Restart the CA service and try again.

What If Nothing Worked? Check the Event Logs

If you're still stuck, the event logs usually hold the real answer. Here's how to check:

1. Open Event Viewer (type eventvwr.msc in Run).
2. Go to Applications and Services Logs > Microsoft > Windows > CertificateServices > Operational.
3. Look for events with ID 4882 or 4883. Those will tell you exactly which signature is missing.
4. The event text will say something like "The request is missing signature from issuer CN=RootCA."
5. That tells you which certificate needs to be added to the request.

Real-world example: I once had a client who was trying to enroll a domain controller certificate. The error 0x8009480A popped up. After checking event logs, we found the request was missing a signature from the root CA. The root CA cert had expired a week earlier. Renewing it on the root and re-importing it fixed everything.

My Final Advice

Start with the service restart. If that doesn't work, double-check your template. For many people, just switching to a simpler template fixes it. And if you're still stuck, the event logs are your best friend — they'll point you straight to the missing cert.

Don't waste time trying to fix the chain if the template is wrong. And don't blame yourself — this error is cryptic and catches everyone off guard the first time.