Re: Certificate Issue Lifetime
From: Brian Komar (bkomar@komarconsulting.com)
Date: 08/19/02
- Next message: TM: "The local policy does not allow you to login interactively"
- Previous message: Mark: ""HOW DO I" locate logged on workstations"
- In reply to: Jason Penn: "Certificate Issue Lifetime"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: Brian Komar <bkomar@komarconsulting.com> Date: Mon, 19 Aug 2002 10:20:33 -0500
In article <39ae01c24773$94801bb0$37ef2ecf@TKMSFTNGXA13>,
penn@netcom.com says...
> Where can you change the certificate issue lifetime?
>
> Specifically for the Root CA and Sub-CA's?
>
> Jason
>
For the root CA, you must designate the certificate lifetime during the
creation of the CA, or when you renew the CA certificate.
At installation, you input the certificate lifetime in the wizard.
At certificate renewal, you must create a capolicy.inf file in the
%windir% folder. In the capolicy.inf file, you must include the
following information:
[certsrv_server]
RenewalKeyLength= 2048
RenewalValidityPeriod = 10
RenewalValidityPeriodUnits = Years
This will renew the certifiate with a 2048 bit key that is valid for 10
years.
If you are setting the validity period for a subordinate CA, the
validity period is a function of two separate settings:
In short, the validity period is the lesser of the validity period of
the Subordinate Certification Authority template and the validity period
settings of the CA that issues the Subordinate Certification Authority
certificate.
At every CA in your CA hierarchy, you can define the maximum lifetime
for any certificates issued by the CA. This is done by editing two
registry entries at the CA:
HKLM\System\CurrentControlSet\SErvices\CertSvc\Configuration\<CAName>:
ValidityPeriodUnits: 5
ValidityPeriod: Years
**Note, these do not match up to the capolicy.inf settings, where Period
is the numeric and units is the time frame used. In the registry, the
units is the numeric value and Period is the time frame used.
HTH,
Brian
- Next message: TM: "The local policy does not allow you to login interactively"
- Previous message: Mark: ""HOW DO I" locate logged on workstations"
- In reply to: Jason Penn: "Certificate Issue Lifetime"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
