Re: Demote Root CA to subordinate - lose existing certs?

Thank you Brian.

What's the correct sequence to follow? Do I :
1. Uninstall CS on the "root-to-be-demoted". then
2. Reinstall CS on same machine, selecting as an EntSubCA, then
3. Run "certutil -dcinfo deleteall" ?
Or do I run the deleteall before uninstalling CS?

Can I control which CA will issue the new DC certs?
I'd prefer they come off the new SubCA, rather than the single RootCA that
is to remain (ie subs do all the issuing).

Thanks again,
Cam


"Brian Komar (MVP)" wrote:

You will have to reinstall and replace the DC certificates.
But, this is easy.
certutil -dcinfo deletebad
(after the last CRL is expired)
Alternatively, run "certutil -dcinfo deleteall"
This will cause all DCs in the domain to replace their DC cert with an
updated certificate
Brian

"CH" <CH@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:C1593307-FF0A-4801-BF17-F6B344FA26EF@xxxxxxxxxxxxxxxx
With my limited understanding of Certificate Services (until now -
hopefully
I'm learning!), I realize that sometime in the past I have created
multiple
Enterprise Root CAs in the organisation. I have now read that this is OK,
but not desirable.

I'd like now to demote one rootCA back to an Ent Subordinate CA and retain
a
single RootCA, and I'm guessing this is going to involve uninstalling
CertSvc
and reinstalling on the machine being "demoted".

My big concern is the existing certs that have already been issued by that
CA - apart from it's own, it has issued Dom Controller certs for another 4
DCs.

How best can I handle this?
Can I uninstall/reinstall CertSvc without affecting the DCs who have certs
issued by this machine?

Any help would be much appreciated,
Cam


.

Relevant Pages

  • Re: Demote Root CA to subordinate - lose existing certs?
    ... What's the correct sequence to follow? ... Reinstall CS on same machine, selecting as an EntSubCA, then ... You should publish the Domain Controller and Domain Controller Authentication certs at the subCA only. ... > DCs. ...
    (microsoft.public.windows.server.security)
  • Admin did not activate prod. server
    ... If I reinstall will it overwrite the ... certs and registry keys? ...
    (microsoft.public.windows.server.setup)