Hi Rich,
I think you are 100% right with 1) or 2).
BTW, I requested a 3yr certificate for a customer today. New Windows 10 Pro virtual machine, standard settings. Opened IE and accepted all the requested security settings. Certificate request worked without any problem.
Friedrich