Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

Enterprise Subordinate Certificate Authority Validity Period

12 views
Skip to first unread message

AlanW.

unread,
Jan 6, 2010, 11:58:16 AM1/6/10
to
We have recently implemented a two tier Certificate Authority
infrastructure.
Our Root Certificate has a validity period of 20 years. This is what
we wanted.

I am now in the process of trying to generate our Subordinate CA
Certificate. The validity period, I believe, is being pulled from the
Certificate Template on the Root CA, and is generating a validity
period of 5 years. I cannot seem to find a way to change this.
I have tried tinkering with the CAPolicy.inf file, but the settings
seem to be ignored.
Our current CAPolicy.inf file is located at C:\Windows on both our
root and Subordinate CA.
The contents are below:

[Version]
Signature= "$Windows NT$"
[Certsrv_Server]
RenewalKeyLength=4096
RenewalValidityPeriod=Years
RenewalValidityPeriodUnits=20
[CRLDistributionPoint]
[AuthorityInformationAccess]

All I need the Policy to do is extend the validity period of our
Subordinate CA certificate from 5 to 20 (or even 15 or 10) years.

I do not seem to be having much success with this.
Thanks for any assistance.

AlanW.

unread,
Jan 7, 2010, 7:17:03 PM1/7/10
to
I have resolved this issue.
The solution was a combination of Root CA Templates and Subordinate
CAPolicy.inf file.

I needed to create new certificate Template on my root CA, since the
Subordinate was selecting the SubCA Template by default.
Once I created a new Template with a longer validity period, I
modified the CAPolicy.inf file on the Subordinate CA

The Subordinate Template's CAPolicy.inf file needs to have:

[RequestAttributes]
CertificateTemplate = <your custom SubCA template>

Thanks!

Jorge Silva

unread,
Jan 11, 2010, 4:24:58 PM1/11/10
to
Hi
Also note that the defaults (For all CERTs) can be changed by using:
certutil -setreg CA\ValidityPeriodUnits 10
certutil -setreg CA\ValidityPeriod "Years"
These values can also be changed at:
HKLM-SYSTEM-CurrentControlSet-Services-CertSrv-Configuration-CAName
ValidityPeriod
ValidityPeriodUnits

--

I hope that the information above helps you.
Have a Nice day.

Jorge Silva
MVP Directory Services

Please no e-mails, any questions should be posted in the NewsGroup
This posting is provided "AS IS" with no warranties, and confers no rights.


"AlanW." <adw...@gmail.com> wrote in message
news:abd22838-0581-4e03...@s31g2000yqs.googlegroups.com...

0 new messages