I was asked to get an SSL certificate for an "Oracle Application Server 11g" which has a soon-to-expire certificate. Brushing aside the fact that 10g seems to be the newest version, I got a certificate from InCommon, as I usually do without problem (except this is the first time I supplied Oracle Application Server 11g as the software type on the CSR form). On the email containing links to download the certificate, it mentioned:

Certificate Details:

SSL Type : InCommon SSL

Server : OTHER

I forwarded the email over to the person responsible for installing it and got a reply that the server type must be Oracle Application Server for the certificate to work (the CN is the same as before). They were unable to install this certificate (no details provided to me) and mentioned they had this issue previously with Thawte when they didn't supply Oracle Application Server as the server type. I don't see any significant difference between the currently installed certificate (working) and the new one I just got signed by InCommon (not working).

$ openssl x509 -in sso-current.cer -text

shows, with irrelevant information ommitted.

Data:
    Version: 3 (0x2)
Signature Algorithm: sha1WithRSAEncryption
    Issuer: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium Server CA/[email protected]
    Validity
        Not Before: Oct  1 00:00:00 2009 GMT
        Not After : Nov 28 23:59:59 2012 GMT
    Subject Public Key Info:
        Public Key Algorithm: rsaEncryption
            Public-Key: (2048 bit)
            Modulus:
            Exponent: 65537 (0x10001)
    X509v3 extensions:
        X509v3 Basic Constraints: critical
            CA:FALSE
        X509v3 CRL Distribution Points: 

            Full Name:
              URI:http://crl.thawte.com/ThawteServerPremiumCA.crl

        X509v3 Extended Key Usage: 
            TLS Web Server Authentication, TLS Web Client Authentication
        Authority Information Access: 
            OCSP - URI:http://ocsp.thawte.com

Signature Algorithm: sha1WithRSAEncryption

and

$ openssl x509 -in sso-new.cer -text

shows

Data:
    Version: 3 (0x2)
Signature Algorithm: sha1WithRSAEncryption
    Issuer: C=US, O=Internet2, OU=InCommon, CN=InCommon Server CA
    Validity
        Not Before: Nov  8 00:00:00 2012 GMT
        Not After : Nov  8 23:59:59 2014 GMT
    Subject Public Key Info:
        Public Key Algorithm: rsaEncryption
            Public-Key: (2048 bit)
            Modulus:
            Exponent: 65537 (0x10001)
    X509v3 extensions:
        X509v3 Authority Key Identifier: 
            keyid:48:4F:5A:FA:2F:4A:9A:5E:E0:50:F3:6B:7B:55:A5:DE:F5:BE:34:5D

        X509v3 Subject Key Identifier: 
            18:8D:F6:F5:87:4D:C4:08:7B:2B:3F:02:A1:C7:AC:6D:A7:90:93:02
        X509v3 Key Usage: critical
            Digital Signature, Key Encipherment
        X509v3 Basic Constraints: critical
            CA:FALSE
        X509v3 Extended Key Usage: 
            TLS Web Server Authentication, TLS Web Client Authentication
        X509v3 Certificate Policies: 
            Policy: 1.3.6.1.4.1.5923.1.4.3.1.1
              CPS: https://www.incommon.org/cert/repository/cps_ssl.pdf

        X509v3 CRL Distribution Points: 

            Full Name:
              URI:http://crl.incommon.org/InCommonServerCA.crl

        Authority Information Access: 
            CA Issuers - URI:http://cert.incommon.org/InCommonServerCA.crt
            OCSP - URI:http://ocsp.incommon.org

Nothing jumps out at me as the reason one would not work so I don't have a specific request for the signer for what to do differently when re-signing.