> Source: [sk103757](https://support.checkpoint.com/results/sk/sk103757)

# sk103757 - Certificate enrolment / renewal fails when outdated smartcards are used

| Property | Value |
|----------|-------|
| Solution ID | sk103757 |
| Date Created | 2015-01-05 |
| Last Modified | 2015-01-06 |
| Technical Level | Advanced |
| OS | Windows |

## Symptoms

- * Certificate enrollment to the Smartcard fails with "Registration failed" error immediately after pressing Enroll button.  
  Enrollment directly to Windows CAPI store works as expected. The Smartcard is accessible and authentication with an existing and valid certificate stored on it is successful.  
* The TrGUI.log file shows:

  ```
  
  [PID][DATE TIME][RaisEnroll] RaisEnroll::GenerateKeys: called with key_len: 2048 and index 0
  [PID][DATE TIME][]cpCAPIEnroll_imp::GenKey_ForProvider_X: createPKCS10 failed (80090009)
  [PID][DATE TIME][] ??????? ???????????? ?????.
  
  
  [PID][DATE TIME][RaisEnroll] RaisEnroll::GenerateKeys: Failed to generate key
  [PID][DATE TIME][RaisEnroll] RaisEnroll::GenerateKeys:  ??????? ???????????? ?????.
  
  
  [PID][DATE TIME][RaisEnroll] RaisEnroll::EnrollCertificate: Failed to generate keys
  [PID][DATE TIME][TR_API] TR_API::TrEnrollCAPICertificateEx: EnrollCertificate failed.
  [PID][DATE TIME][TrGUI] TrConnectDialog::EnrollCAPICertificate: TrEnrollCAPICertificate failed.
  
  ----------------------------------------------------------------------------------------------------------
  [PID][DATE TIME][RaisEnroll] RaisEnroll::EnrollCertificate: Enter
  [PID][DATE TIME][RaisEnroll] RaisEnroll::GenerateKeys: called with key_len: 2048 and index 0
  [PID][DATE TIME][] cpCAPIEnroll_imp::GenKey_ForProvider_X: put_KeySpec failed (80070005)
  [PID][DATE TIME][] ???????? ? ???????.
  ```

## Cause

1024 bit keys are still supported, but they are not considered as safe for SSL purposes. Since E80.50, the default RSA key size used for the new certificates generation was changed from 1024 bits to 2048 bits. As a result, some outdated Smartcards that can not generate 2048 private keys fail to enroll / renew certificates.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content