Score:2

How to set the lifetime of a CA certificate?

us flag

I'm trying to install a subordinate CA with Microsoft ADCS and when I do, it creates a .req file. Then I use that at the root CA to issue a certificate. The resulting certificate is always for 5 years. I want it to be 10. I have tried setting ValidityPeriod=Years and ValidityPeriodUnits=10 in the CAPolicy.inf file on the subordinate CA. And I have tried various other things, but nothing seems to make any difference. The installation command I'm using is:

Install-AdcsCertificationAuthority -CAType EnterpriseSubordinateCA -CACommonName "IssuingCA" -KeyLength 2048 -HashAlgorithm SHA256 -CryptoProviderName "RSA#Microsoft Software Key Storage Provider"

I uninstalled and tried to reinstall with -ValidityPeriod years -ValidityPeriodUnits 10 in the command, but got an error: Install-AdcsCertificationAuthority : Property cannot be modified in current state of object. Current CA Type does not allow this property to be modified. Two or more parameter values specified for a resource's properties are in conflict. 0x80071709 (WIN32: 5897 ERROR_CLUSTER_PARAMETER_MISMATCH)

Does anyone else know how to do this?

cn flag
how long is valid your root CA? Is your root CA running Microsoft CA, or 3rd party? If it is Microsoft CA, what type it is, Standalone or Enterprise?
Roman avatar
us flag
The root CA is Microsoft standalone (offline) root. I was able to get it to do 20 years apparently by setting the CAPolicy.inf RenewalValidityPeriod settings.
Score:2
pe flag

You cannot set the ValidityPeriod and ValidityPeriodUnits arguments when installing a new Enterprise Subordinate CA. This is instead done by modifying the policy on the root CA by utilizing the following commands:

certutil -setreg ca\ValidityPeriodUnits 10
certutil -setreg ca\ValidityPeriod Years

Don't forget to restart the CertSrv service after. You can then issue the issuing CA certificate and it will be valid for 10 years, as long as your root CA is valid for longer than that.

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.