I know this was posted a few years ago, but for the sake of completeness, the solution is probable: certutil -setreg ca\CRLFlags +CRLF_ALLOW_REQUEST_ATTRIBUTE_SUBJECT As MS Certificate Services does not enable support for Netscape/Firefox by default (for some strange reason). I found this information...