Renewing Microsoft root CA certificate

Hi expert,

we have an ActiveDirectory and a Microsoft CA here.
The certificate of that CA will expire in August, 2015.

Because we don`t want (client-)certificates with  retention periods < 1 year, we have to rene the CA-certificate next month.
So as I saw, there is the possibility to create a new pair of keys or to use the existings one.
My currently issued certificates must be valid after renewal. Does this mean, that I have to keep the existing pair of keys?

Will renewing with the existing pair affect any already issued certificates, or will they work on until their end date?

And I have one problem:
When right-clicking the root-CA I see 2 root certifactes, that are valid at the Moment (Nr.2, Nr.3).
Thre are 2 old certificates (Nr.0, Nr.1) that are expired.

Is this nomal?
Why are there 2 certificates?
Do I have to renew both certificates?

I hope that renewing process will be straight forward.

Thanks in advance for your answers.

Best regards
Roland
SystemadministrationAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

MaheshArchitectCommented:
You can renew CA certificate with either new key pair or same key pair, it does not matter
When you generate a new key pair for a CA that is being renewed, a new certificate revocation list (CRL) distribution point is also created. This is to ensure that the key used to sign a certificate issued by the CA also matches the key used to sign the CRL
Or you can use existing key pair if wanted to.

The already issued certs have their expiry date set \ hardcoded in issued certificate itself, so they will expire at that time, you cannot extend there expiry date by renewing CA certificate, after you renew CA certificate, the new certificates that CA will issue will get full \ proper expiry period that is mentioned in certificate template

Important thing, CA cannot issue certificates with more validity period than its own certificate expiry period
Hence you need to renew CA certificate with either existing pair \ new pair before its certificate gets expired otherwise all your issued certificate will automatically get expired. Furthermore I guess you still need to renew your existing issued certs as well because there expiry date also might be equal \ less than CA certificate expiry date.
you cannot renew expired certificate. You have to renew it before it expires. Otherwise you need to request new certificate

Last thing, the certificates with No.0 and 1 are expired as per there validity period and that is why you have renewed No.2 and 3 later on.
hence its normal
You need to renew the last certificate (No.3) only

Check below topic in this http://technet.microsoft.com/en-us/library/cc740209(v=ws.10).aspx MS article
The validity period of a CA and the validity period of the certificates it issues
1
SystemadministrationAuthor Commented:
Thank you for your answer!
So there will be no risk when renewing the cert?

I don`t understand why there is No. 2 and No.3 with the same expiry date.
Why are there 2 valid certificates and not just one?
0
MaheshArchitectCommented:
Yes, definitely no risk

Your administrator must have renewed CA root certificate multiple times causing you found 2 and 3 certificates.

Even there are multiple valid CA certs only the most recent CA certificate is used for new certificate request signing.
You can check both certificate validity in certificate properties, as already stated earlier Certificate NO.3 must be recent certificate.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
SystemadministrationAuthor Commented:
OK, it seems,that there were two root-certificates renwed last time.
But in certificate list I see only cetificates which use the No. 3 as root certificate.
Ich will renew No. 3 tommorow and hope I will be save.

No.2 will expire in August and No.3 should stay valid.

Right?
0
MaheshArchitectCommented:
Yes, That's right.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Encryption

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.