Re: renew CA certificate

From: Brian Komar [MVP] (bkomar_at_nospam.identit.ca)
Date: 09/19/05

  • Next message: Brian Komar [MVP]: "Re: IIS 6 behavior on checking clients' certificates (again)" 
    Date: Mon, 19 Sep 2005 09:24:16 -0500

    In article <eIOUj3RvFHA.3932@TK2MSFTNGP15.phx.gbl>,
    only_n_groups_account_but_works@yahoo.de says...
    > Hi all
    >
    > When I renew the CA certificate, I can`t specify the period of validity.
    > How can I do that?
    >
    > Thanks.
    >
    It depends on whether the CA is a root CA or a subordinate CA.
    If it is a root CA.

    1) Create or edit %windir%\capolicy.inf
    2) Add the following content, for example, to renew with a 10 year
    validity period and a 2k key

    [Version]
    Signature="$Windows NT$"

    [certsrv_server]
    renewalkeylength=2048
    RenewalValidityPeriodUnits=10
    RenewalValidityPeriod=years

    ** There are many other entries that are required for a nt to you I am
    just focusing on the lines pertinent to your question

    3) Renew the certificate

    If it is a subordinate CA certificate, then you must configure the
    parent CA to define the subordinate CA's validity period. Note that you
    can only issue a certificate with a validity period less than the
    remaining validity period of the parent CA. To set the validity period
    for a subordinate CA, add the following lines to a batch file and run.
    This example sets the lifetime to 5 years.

    ::Set Validity Period for Issued Certificates
    certutil -setreg CA\ValidityPeriodUnits 5
    certutil -setreg CA\ValidityPeriod "Years"

    HTH,
    Brian

  • Next message: Brian Komar [MVP]: "Re: IIS 6 behavior on checking clients' certificates (again)"

    Relevant Pages

    • Re: Question on chnaging the expiration date of certificates
      ... your Standalone RootCA is valid for 10 years ... your subordinate CA will only be able to issue certificates ... valid for maximum 1 year since its own certificate is valid for that period ... What you need to do is change the validity period on your RootCA to value ...
      (microsoft.public.win2000.security)
    • Re: Windows 2003 CA 0x80092013
      ... > get CA services working but now I get these errors when trying to issue ... > Certificate The certificate validity period will be shorter than the ... > period is longer than the maximum certificate validity period allowed by ... This could be for any or all of the CAs in the CA hierarchy ...
      (microsoft.public.security)
    • Re: Validity period of certificates is not accepted anymore
      ... The CA policy module will always truncate the validity of an issued cert to ... be within the lifetime of its own validity period. ... Best Practices for implementing Windows Server 2003 PKI: ... Troubleshooting Certificate Status and Revocation whitepaper: ...
      (microsoft.public.platformsdk.security)
    • Re: certutil -sign equivalent
      ... "Oriane" wrote in message ... > | The validity written into a certificate is determined by two factors, ... > | validity period defined on the cert template (If the CA is Enterprise ... > | If you want to have control over validity period per request, ...
      (microsoft.public.platformsdk.security)
    • Re: AD CS 2008 & Subordinate CA Validity Periods?
      ... The validity period of issued certificate is defined at the issuing CA. ... you cannot define it at the subordinate CA in the capolicy.inf file. ...
      (microsoft.public.windows.server.security)