One problem we come accross quite regularly is that of Windows Vista or 2008 Servers not being able to request / download certificates from a Certificate Server running on Windows Server 2003.

This is once again due to ActiveX funtionality (Xenroll) which has been removed from Vista / 2008 & requires you to patch your Certificate Server in order to enable the functionality again.

Further details can be found in Microsoft KB Article KB922706