Solved

Renewing Microsoft root CA certificate

Posted on 2014-07-25
5
497 Views
Last Modified: 2014-09-15
Hi expert,

we have an ActiveDirectory and a Microsoft CA here.
The certificate of that CA will expire in August, 2015.

Because we don`t want (client-)certificates with  retention periods < 1 year, we have to rene the CA-certificate next month.
So as I saw, there is the possibility to create a new pair of keys or to use the existings one.
My currently issued certificates must be valid after renewal. Does this mean, that I have to keep the existing pair of keys?

Will renewing with the existing pair affect any already issued certificates, or will they work on until their end date?

And I have one problem:
When right-clicking the root-CA I see 2 root certifactes, that are valid at the Moment (Nr.2, Nr.3).
Thre are 2 old certificates (Nr.0, Nr.1) that are expired.

Is this nomal?
Why are there 2 certificates?
Do I have to renew both certificates?

I hope that renewing process will be straight forward.

Thanks in advance for your answers.

Best regards
Roland
0
Comment
Question by:Systemadministration
  • 3
  • 2
5 Comments
 
LVL 35

Expert Comment

by:Mahesh
ID: 40220336
You can renew CA certificate with either new key pair or same key pair, it does not matter
When you generate a new key pair for a CA that is being renewed, a new certificate revocation list (CRL) distribution point is also created. This is to ensure that the key used to sign a certificate issued by the CA also matches the key used to sign the CRL
Or you can use existing key pair if wanted to.

The already issued certs have their expiry date set \ hardcoded in issued certificate itself, so they will expire at that time, you cannot extend there expiry date by renewing CA certificate, after you renew CA certificate, the new certificates that CA will issue will get full \ proper expiry period that is mentioned in certificate template

Important thing, CA cannot issue certificates with more validity period than its own certificate expiry period
Hence you need to renew CA certificate with either existing pair \ new pair before its certificate gets expired otherwise all your issued certificate will automatically get expired. Furthermore I guess you still need to renew your existing issued certs as well because there expiry date also might be equal \ less than CA certificate expiry date.
you cannot renew expired certificate. You have to renew it before it expires. Otherwise you need to request new certificate

Last thing, the certificates with No.0 and 1 are expired as per there validity period and that is why you have renewed No.2 and 3 later on.
hence its normal
You need to renew the last certificate (No.3) only

Check below topic in this http://technet.microsoft.com/en-us/library/cc740209(v=ws.10).aspx MS article
The validity period of a CA and the validity period of the certificates it issues
1
 

Author Comment

by:Systemadministration
ID: 40223595
Thank you for your answer!
So there will be no risk when renewing the cert?

I don`t understand why there is No. 2 and No.3 with the same expiry date.
Why are there 2 valid certificates and not just one?
0
 
LVL 35

Accepted Solution

by:
Mahesh earned 400 total points
ID: 40225064
Yes, definitely no risk

Your administrator must have renewed CA root certificate multiple times causing you found 2 and 3 certificates.

Even there are multiple valid CA certs only the most recent CA certificate is used for new certificate request signing.
You can check both certificate validity in certificate properties, as already stated earlier Certificate NO.3 must be recent certificate.
0
 

Author Comment

by:Systemadministration
ID: 40238341
OK, it seems,that there were two root-certificates renwed last time.
But in certificate list I see only cetificates which use the No. 3 as root certificate.
Ich will renew No. 3 tommorow and hope I will be save.

No.2 will expire in August and No.3 should stay valid.

Right?
0
 
LVL 35

Expert Comment

by:Mahesh
ID: 40238368
Yes, That's right.
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Envision that you are chipping away at another e-business site with a team of pundit developers and designers. Everything seems, by all accounts, to be going easily.
Disabling the Directory Sync Service Account in Office 365 will stop directory synchronization from working.
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

864 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now