Hi,
It's seem to be related to bug CSCvf35994 (which has no efficient workaround).
I faced this error message on a IR809 router (15.9(3)M2a) when trying to "authenticate" a CA certificate.
As the router was OK to add other CA certificate I noticed that the one refused was slightly different because it only had one Key Usage extension, namely "Certificate-Signing" (Key Cert Sign).
After several test we discovered that that IOS need another Key Usage, in our case Digital Signature.
Hope this could help.
