Processing new certificate requests requires the Web service to be trusted for delegation. Renewal-only mode allows only ...

Processing new certificate requests requires the Web service to be trusted for delegation. Renewal-only mode allows only certificate renewal requests, and delegation is not required. This might be appropriate when increased security is necessary; for example, when the Web service is deployed to the internet.
    
Note: When renewal-only mode is selected, the specified CA must be running on Windows Server 2008 R2.