Re: How to install a new Enterprise Root Certificate Authority to replace an old one?

From: Brian Komar (bkomar_at_nospam.komarconsulting.com)
Date: 04/24/04

  • Next message: Brian Komar: "Re: How to install a new Enterprise Root Certificate Authority to replace an old one?" 
    Date: Sat, 24 Apr 2004 16:15:27 -0500

    Answers inline...
    Brian

    In article <uH94S0RKEHA.1120@TK2MSFTNGP11.phx.gbl>,
    umetricsdev@umetrics.com says...
    > Thanks again,
    >
    > Sadly, that solution isn't really practical for me (I've already setup the
    > new DC with a different name and moved lots of stuff from the old DC to it,
    > and besides I don't want to keep the old name around! :=) ).
    >
    > So back again to my original questions:
    >
    > Can I install a second Root Enterprise CA in the domain in parallel with the
    > old CA?
    Yes, this is just another root CA in the organization, that will use the
    same certificate templates available in the Configuration naming
    context. When you install the new root CA, information will be added to
    the AIA, CDP and Certificate Services containers in the following
    location: CN=Public Key
    Services,CN=Services,CN=Configuration,ForestRootDomainLDAPName

    > Or must I uninstall the first CA first?
    The order does not really matter except that you should clean the old CA
    references out of the Configuration NC. What I recommend is to use the
    PKi Health Tool from the 2003 Resource Kit (pkiview.msc). You can then
    view each container, and delete the old certs and CRLs from the
    Configuration NC.

    >
    > And in both cases, how does it affect my clients, or rather, how do I make
    > the inpact as little as possible? (These questions are more elaborated in
    > my original post in this thread).
    >

    The impact will be that all old certs are dead/gone/toast. You should
    plan for the immediate deployment of required certificates. Once you
    uninstall or remove the old CA, all certificate validation will break
    down at the next CRL publish interval for the old CA.

    > / Erik
    >
    <snip>

  • Next message: Brian Komar: "Re: How to install a new Enterprise Root Certificate Authority to replace an old one?"

    Relevant Pages

    • Re: Certificate authorities and firewalls
      ... Make the SA Root certificate and CRLs outside of the firewall ... extension to include an externally accessible location where the CRLs and CA ... If the firewall does not allow the SARootCA machine to publish to these two ...
      (microsoft.public.win2000.security)
    • Re: Certificate chain issue with Ent Sub Ca & stand alone Root CA
      ... certificate and I get a "Cannot verify certificate chain. ... revocation because the revocation server was offline. ... the root ca? ... Online>>> Online Enterprise Subordinate CA ...
      (microsoft.public.windows.server.security)
    • Re: Newbie wants to learn about PKI Server 2003......
      ... 2003 PKI Certificate Security", and have been lurking here for a bit. ... We will implement a 2 tier heirarchy, with the Root CA being offline. ... All clients that attempt revocation checking will first attempt to retrieve the CRL from the ... level below a self-signed cert, so applications that are 3280 compliant would never check the ...
      (microsoft.public.windows.server.security)
    • Re: Is it possible??.... Defining Root Certificate KeyUsage
      ... For instance, the self signed certificate ... intermediate servers list every possible key usage defined within the PKI ... Component Verification, OEM Windows System Component Verification, Embedded ... Since the only use these root and intermediate keys are designed for is ...
      (microsoft.public.security)
    • Re: Is it possible??.... Defining Root Certificate KeyUsage
      ... For instance, the self signed certificate ... intermediate servers list every possible key usage defined within the PKI ... Component Verification, OEM Windows System Component Verification, Embedded ... Since the only use these root and intermediate keys are designed for is ...
      (microsoft.public.inetserver.iis.security)