Certificate Services - Sub Ca Issue

[elway7]

I am trying to set up the following environment: Standalone Root CA and Enterprise Sub CA, both running windows 2008 R2 core.

To set up the ROOT CA i have done the following:
Install the Certificate Services Roll by typing the following at the command line:
Cscript C:\Windows\System32\setupca.vbs /IS /sn RootCA /sp "RSA#Microsoft Software Key Storage Provider" /sk 2048 /sa SHA256 /SV 20
Run the following commands on the ROOT CA to set the issuing validity period to 20 years

certutil -setreg ca\ValidityPeriod "Years"
certutil -setreg ca\ValidityPeriodUnits "20"
net stop certsvc & net start certsvc

Install the CRL List in Active Directory by running the following commands
Certutil setreg ca\DSConfigDN CN=Configuration, DC=Test,dc=local
Certutil setreg ca\DSDomainDN DC=Test,dc=local
Net stop certsvc & net start certsvc
Certutil dspublish f C:\windows\system32\CertSrv\CertEnroll\Root CA.crl

For the SUB CA I run the follwoing command:

Cscript C:\Windows\System32\setupca.vbs /IF /sn Sub CA /DN DC=DC=Test,dc=local /sp "RSA#Microsoft Software Key Storage Provider" /sk 2048 /sa SHA256 /OR "C:\CA\SUBReq.req"

I then submit the request to the ROOT CA and subsequently issue the pending request. When I try to accept the response using the certreq -accept command I get the following error:
Certificate Request Processor: Cannot Find object or property
and of course the SUB CA will not start as it does not have a vaild certificate.

I have even tried to create a new certificate and although i can import it using the certreq -accept command the service will not start correctly.

Any help would be appreciated...

Thanks in advance

 

[ICTCity]

Are you sure this is correct?

/DN DC=DC=Test,dc=local

It should be:

/DN DC=Test,dc=local

Maybe I'm wrong... but this is my only idea.

 

[elway7]

That is a typo by my part...i do in fact have /DN DC=Test,dc=local

 

[ICTCity]

So I think your problem is the private key, in some way Windows cannot find it anymore and so cannot associate the pair.

I found this article, http://technet.microsoft.com/en-us/library/dd362655.aspx but it is useless because you need the GUI in order to proceed. No idea, sorry.