On a Windows Server 2003-based or Windows XP-based computer, you cannot obtain certificates from a Windows Server 2008-based certification authority (CA). This issue occurs if the CA is configured to use SHA2 256 encryption or higher encryption (SHA2 384 or SHA2 512).
Install this update on the Windows XP clients but also on the Windows 2003 Domain Controllers!
Windows 2000, 2003 and XP Update for Base Smart Card Cryptographic Service Provider
Base Smart Card Cryptographic Service Provider (Base CSP) allows smart card vendors to more easily enable their smart cards on Windows with a lightweight proprietary card module instead of a full proprietary CSP.
Install this update on the Windows XP clients!