title: PKI problems locations in Enterprise PKI mmc
body: <p>I did a "renew Cert" on one of my Enterprise subCAs, and it's totally messed up my results on Enterprise PKI in MMC.  In the Certificate Authority snapin, there are now two certs (Certificate #0 and #1). The AIA (ldap) is showing "Unable to Download", with the "original CN=". The CDP (ldap) location has a (1) on it, as does the DeltaCRL. Every time I renew the revocation, it makes both the original cert's crl and a (1). The CDP/DeltaCRL (http) also both show "unable to download", even though the files exist in the directory. The only AIA location that shows OK is the http location.</p>
  
  <p>I need to get rid of the old CA cert (the #0), I'll re-push the new one out via a GPO once this all is resolved.  I tried to remove the AIA via ADSIEdit, and then republish it via "certutil -dspublish" but that gives me a  0x80070057 (WIN32: 87 ERROR_INVALID_PARAMETER) error. Trying to connect to the Configuration of the specific CA via ADSIEdit says "server is not operational". In ADSIEdit CN=CDP there are multiple entries, the normal "CA", a "CA-1", and a "CA-1(1)".</p>
  
  <p>This is in our "Test" environment (luckily), but I need to get a proper process sorted out as I need to do this in two other forests.  I'm actually tempted to just totally rebuild a new CA in the other zones instead of fighting with all of this.
  All I'm trying to do is re-issue a subCA's cert, and get it to work correctly and report healthy in Enterprise PKI!</p>
  
  <p>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\OMNI-
  TST-CERTAUTH-01-CA-1\CRLPublicationURLs:</p>
  
  <p>CRLPublicationURLs REG_MULTI_SZ =
      0: 65:C:\windows\system32\CertSrv\CertEnroll\%3%8%9.crl
      CSURL_SERVERPUBLISH -- 1
      CSURL_SERVERPUBLISHDELTA -- 40 (64)</p>
  
  <pre><code>1: 79:ldap:///CN=%7%8,CN=%2,CN=CDP,CN=Public Key Services,CN=Services,%6%10
  CSURL_SERVERPUBLISH -- 1
  CSURL_ADDTOCERTCDP -- 2
  CSURL_ADDTOFRESHESTCRL -- 4
  CSURL_ADDTOCRLCDP -- 8
  CSURL_SERVERPUBLISHDELTA -- 40 (64)
  
  2: 134:http://pki.omni.phish/CertEnroll/%3%4%9.crl
  CSURL_ADDTOCERTCDP -- 2
  CSURL_ADDTOFRESHESTCRL -- 4
  CSURL_ADDTOIDP -- 80 (128)
  </code></pre>
  
  <p>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\OMNI-
  TST-CERTAUTH-01-CA-1\CACertPublicationURLs:</p>
  
  <p>CACertPublicationURLs REG_MULTI_SZ =
      0: 1:C:\Windows\system32\CertSrv\CertEnroll\%1_%3%4.crt
      CSURL_SERVERPUBLISH -- 1</p>
  
  <pre><code>1: 3:ldap:///CN=%7,CN=AIA,CN=Public Key Services,CN=Services,%6%11
  CSURL_SERVERPUBLISH -- 1
  CSURL_ADDTOCERTCDP -- 2
  
  2: 32:http://%1/ocsp
  CSURL_ADDTOCERTOCSP -- 20 (32)
  
  3: 32:http://pki.omni.phish/oscp
  CSURL_ADDTOCERTOCSP -- 20 (32)
  
  4: 2:http://pki.omni.phish/CertEnroll/%3.crt
  CSURL_ADDTOCERTCDP -- 2
  </code></pre>