Hello!
I have 1 RootCA (Win 2008 R2 SP1 Standalone Root) and 2 Cisco Routers (3825 15.0(1)M6 and 2911 15.3T). I can enroll certificate for the first time with password from RootCA (this password never expired).
On Cisco Routers in trustpoint configuration I enter command auto-enroll 15 regenerate, but auto enrollment not working.
If I try manually to reenrol certificate (crypto pki enroll RootCA) in debug I see message:

CRYPTO_PKI: Begin shadow operation - skip current enrollment
PKI: Shadow state for MCSM1ROOT now NOSTATE
CRYPTO_PKI: Capabilites already obtained 80000004
PKI: Shadow state for MCSM1ROOT now NOT_SUPPORTED
CRYPTO_PKI: Setting renewal timers

Anybody knows how to resolve this problem?