How do I renew a code signing certificate in MS Certificate Services

Posted on 2009-02-17
Last Modified: 2012-05-06
A little over a year ago I enabled Microsoft Certificate Services on one of my servers for the purpose of creating code signing certificates. My intent was to allow a handful of people in my company to sign macros in Access and Excel so that users would not get security warnings when opening these applications. For the past year this has worked flawlessly. Now all of the Code Signing certificates are expired and I don't know how to renew them.

Is there a way to simpley change the expiration date so that all the certificates continue to work? Or do I need to create new certificates and resign all the macros?
Question by:ticgums
    LVL 31

    Expert Comment

    Normally you would create a new code signing certificate.  If you got it from a commercial CA you could buy one with a longer lifespan, if creating from your own CA you can duplicate the default code signing template so you can modify the validity period, if using a self-signed cert you can usually add a switch to the command to make a new one to specify the number of days it should be valid for.

    Author Comment

    I'm creating it from my own CA. Even if I modify the code signing template I could only make it valid for 2 years (length of the CA validity) correct?

    Regardless of how long the certificate is good for once it expires I have to request a new one and resign all of my code? Is there any way to avoid this?
    LVL 31

    Accepted Solution

    You could extend the validity period of the CA certificate and renew it (you can use command 'Certutil -renewCert ReuseKeys' to avoid having to reissue all of your existing certs), and then extend the lifetime of your template.

    Better yet would be using a time stamping service, if your code supports that.  Basically after the cert expires the time stamp is still valid, so you're good until you have to update the code, in which case you would have to re-sign again anyways.  Here's a little more info on that:

    There are a few free time stamping services you can use - there may be a short delay from some of these, but from what I understand its usually under an hour or at least same day, which is acceptable to most people.
    I'm sure there are more out there if you really want to look.

    Featured Post

    How to run any project with ease

    Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
    - Combine task lists, docs, spreadsheets, and chat in one
    - View and edit from mobile/offline
    - Cut down on emails

    Join & Write a Comment

    Experts-Exchange users below are the steps you can follow to upgrade your Lync server to latest CU's or cumulative updates. Note: Perform it during non-production hours.   Step 1: Backup your lync and SQL server database. Follow below article: h…
    The System Center Operations Manager 2012, known as SCOM, is a part of the Microsoft system center product that provides the user with infrastructure monitoring and application performance monitoring. SCOM monitors:   Windows or UNIX/LinuxNetwo…
    It is a freely distributed piece of software for such tasks as photo retouching, image composition and image authoring. It works on many operating systems, in many languages.
    Illustrator's Shape Builder tool will let you combine shapes visually and interactively. This video shows the Mac version, but the tool works the same way in Windows. To follow along with this video, you can draw your own shapes or download the file…

    729 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    19 Experts available now in Live!

    Get 1:1 Help Now