Replace www.contoso.com with the DNS computer name of your web enrollment station. The renewal=-1 parameter indicates that the latest certificate is targeted. The index of the renewal parameter refers to the CA certificate that is actually downloaded. 0 would be the CA certificate that was generated during CA setup. 1 is the CA certificate after the first renewal and so on.