Trying to install a second certificate issued by the same Certificate Authority (CA). However, the new certificate replaces it's predecessor . Original Certificate Enrollment Config: crypto pki trustpoint ca.domain.null enrollment url http://ca.domain.null:80 usage ike ip-address none fingerprint <removed-for-forum-post> subject-name c=CA, st=State, l=City, o=Company, ou=old-1 , ou=old-2 , cn=router.domain.null revocation-check crl source interface Loopback0 rsakeypair router.domain.null 1024 auto-enroll 90 regenerate Amendments to Certificate Enrollment Config: crypto pki trustpoint ca.domain.null subject-name c=CA, st=State, l=City, o=Company, ou=new-1 , ou=new-2 , cn=vpn-1.router.domain.null , hostname=vpn-1.router.domain.null rsakeypair vpn-1.router.domain.null 1024 Note: Amended Organizational Unit (ou) fields. Note: Specified a different Common Name (prepended "vpn-1"). Note: Tried with and without "hostname=vpn-1.router.domain.null". Note: Specified a different RSA keypair. Enrollment for Second Certificate (same CA): router(config)#crypto pki enroll ca.domain.null % % Start certificate enrollment .. % Create a challenge password. You will need to verbally provide this    password to the CA Administrator in order to revoke your certificate.    For security reasons your password will not be saved in the configuration.    Please make a note of it. Password: Re-enter password: % The subject name in the certificate will include: c=CA, st=State, l=City, o=Company, ou=new-1 , ou=new-2 , cn=vpn-1.router.domain.null, hostname=vpn-1.router.domain.null % The subject name in the certificate will include: router.domain.null % Include the router serial number in the subject name? [yes/no]: n Request certificate from CA? [yes/no]: y % Certificate request sent to Certificate Authority % The 'show crypto pki certificate verbose ca.domain.null' command will show the fingerprint. Note: Statement above indicates "% The subject name in the certificate will include: router.domain.null". Note: The new certificate is created with the same name as the original certificate, and replaces it. New Certificate: router(config)#do sh crypto pki certificate Certificate   Status: Available   Certificate Serial Number (hex): 23   Certificate Usage: General Purpose   Issuer:     cn=ca.domain.null   Subject:     Name: router.domain.null     hostname=router.domain.null     c=CA     st=State     l=City     o=Company     ou= new-1     ou= new-2     cn=vpn-1.router.domain.null     hostname= vpn-1.router.domain.null   CRL Distribution Points:     http://ca.domain.null/cgi-bin/pkiclient.exe?operation=GetCRL   Validity Date:     start date: 14:10:41 EST Dec 4 2012     end   date: 04:24:14 EDT Jul 15 2013     renew date: 22:16:52 EDT Jun 22 2013   Associated Trustpoints: ca.domain.null Note: The following remain the same when the new certificate is created, despite the subject-name input provided:   Subject:     Name: router.domain.null     hostname=router.domain.null The original certificate is overwritten with the new one, and is not to be found in the "sh crypto pki certificate" output. Any thoughts or solutions on how to successfully install a second certificate issued from the same CA would be welcome. Best Regards, Mike ... View more