One reason for this problem could be the certificate template being issued. This is applicable to Microsoft Certificates.
Certificate Templates must have the Application Policy set to “Certificate Request Agent” in the “Issuance Requirements” tab. In a recent support case, the customer had this set to “Any Purpose”. The result on the MyID client was the -9990003 error.
But on the CA this problem has a specfic fingerprint. If you check the “Failed Requests” you will see the following;
Request Status Code
One or more signatures did not include the require application or issuance policies. The request is missing one or more required valid signatures. 0x8009480b (-2146875381 CERTSRV_E_SIGNATURE_REJECTED)
Request Disposistion Message
Denied by policy module 0x8009480b, The {certificate template name} Certificate Template requires 1 signatures, but only 0 were accepted.
Changing the Application Policy to “Certificate Request Agent” resolved the problem in the instance of the support case.