• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 2604
  • Last Modified:

Microsoft CA - how to renew a local issued certificate via the Certification Authority

Hi all,

We've got a certificate which was generated on one of our workstations locally. This cert has been published to ~210 workstation and it's working perfectly, but it's end time is coming and in 2 weeks the validity time will be finished.

Now, I think what is the best thing to do:
1. Renew this cert via the CA? Is it possible? How to deploy it via GPO to all users?
2. Create a new cert via the CA and deploy it to all users via GPO.

Thanks in advance
0
IT_Group1
Asked:
IT_Group1
1 Solution
 
David Johnson, CD, MVPOwnerCommented:
How was the CA set up?? please don't tell me, next, next, next, done

are you publishing your CRL's, are your online responders set to auto-authorize requests?
Which certificate is expiring the root ca's? issuing ca's or server/personal cert's ?

view these  videos and see if you have to rebuild from scratch
http://vimeo.com/search?q=brian+komar

Which version of the CA -- server 2008/ server 2008R2 / server 2012 ?
0
 
MaheshArchitectCommented:
Your comment:
This cert has been published to ~210 workstation

Unable to get clarity on above comment

Is the existing certificate is self signed \ issued by internal CA \ External CA server ?

If this is self signed certificate, you cannot renew it.

If certificate is issued by internal CA (AD integrated CA), you can renew it from client machine itself.

If you have Standalone Root CA already in place it cannot work with certificate auto Enrollment and GPO.
In order to automatically enrol certificates to client computers and users, you have to have Enterprise root CA (AD Integrated) server.
Now based on your question I assumed that you have AD integrated enterprise root \ subordinate CA already in place
Please find below article step by step to auto enrol users and computers certificate in active directory
http://www.isaserver.org/img/upl/vpnkitbeta2/autoenroll.htm
The article is written for windows 2003 server, but still work with 2008 \ 2008 R2
Also check below video for better clarity
http://www.labminutes.com/sec0029_user_computer_certificate_auto-entollment

If you have not deployed AD integrated CA server yet, then you must deploy one
http://www.youtube.com/watch?v=Qg_izJtWuiA
Note that you need to install Enterprise root CA on either windows 2008 \ 2008 R2 enterprise edition in order to avail all available option with enterprise CA or you can simply use windows 2012 \ 2012 R2 standard edition.
Also you must be logged on CA server as enterprise admins in a forest
http://technet.microsoft.com/en-us/library/cc772393(v=ws.10).aspx

Mahesh
0
 
IT_Group1Author Commented:
Thanks
0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now