Skip to main content

How to Create Certificates with a Longer Validity Period

 So, you have your own Windows Certificate of Authority (CA) server and you want to create some new certificates that are valid longer than the default certificate templates. You duplicate the User Certificate, and set the validity period to 5 years. You issue a new user certificate using the new template and discover that the certificate expires two years from today. What's up with that?


The validity period of any certificate generated by a Windows CA is the lesser of these three values:

  • The remaining lifetime of the root CA server
  • The value specified in the certificate template
  • The value specified in the CA server registry (default is 2 years)

So even if you set the certificate template validity period to 10 years, certificates issued using this template will be valid for a maximum of two years with the CA's default settings.

Increasing the CA Lifetime
Most root CAs are typically valid for 5 years. To increase the lifetime of the root CA, create or edit a text file in %SYSTEMROOT% called CAPolicy.inf with the following text:
Code:
[Version]
Signature=”$Windows NT$”

[certsrv_server]
RenewalValidityPeriod=Years
RenewalValidityPeriodUnits=10
Adjust the values above as needed, save the file, and restart the CertSrv service. Then renew the CA Certificate using the same public and private key pair.

Warning: If you generate a new public and private key pair you will need to reissue all your old certificates, so don't do it unless that is your intent.

Setting the Maximum Validity Period in the Registry
The default certificate validity period configured in the CA's registry is 2 years. To view the current registry value, run the following commands from a CMD prompt on the CA:
Code:
certutil -getreg ca\ValidityPeriod
certutil -getreg ca\ValidityPeriodUnits
To configure the registry value to 5 years, run the following command from a CMD prompt on the CA:
Code:
certutil -setreg ca\ValidityPeriodUnits 5
Adjust the value above, as needed. Then restart the CertSvc service to affect the changes.

Comments

Post a Comment

Popular posts from this blog

Calculate how much data can be transferred in 24 hours based on link speed in data center

  In case you are planning for migration via DIA or IPVPN link and as example you have 200Mb stable speed so you could calculate using the below formula. (( 200Mb /8)x60x60x24) /1024/1024 = 2TB /per day In case you have different speed you could replace the 200Mb by any rate to calculate as example below. (( 5 00Mb /8)x60x60x24) /1024/1024 =  5.15TB  /per day So approximate each 100Mb would allow around 1TB per day.
Post a Comment
Read more

Integration with vCloud Director failing after NSXT upgrade to 4.1.2.0 certificate expired

  Issue Clarification: after upgrade from 3.1.3 to 4.1.2.0 observed certificate to be expired related to various internal services.   Issue Verification: after Upgrade from 3.1.3 to 4.1.2.0 observed certificate to be expired related to various internal services.   Root Cause Identification: >>we confirmed the issue to be related to the below KB NSX alarms indicating certificates have expired or are expiring (94898)   Root Cause Justification:   There are two main factors that can contribute to this behaviour: NSX Managers have many certificates for internal services. In version NSX 3.2.1, Cluster Boot Manager (CBM) service certificates were incorrectly given a validity period of 825 days instead of 100 years. This was corrected to 100 years in NSX 3.2.3. However any environment originally installed on NSX 3.2.1 will have the internal CBM Corfu certs expire after 825 regardless of upgrade to the fixed version or not. On NSX-T 3.2.x interna...
Post a Comment
Read more

Recreating a VMFS-3 or VMFS-5 partition table in ESXi 5.x

For this kind of issues you need to engage VMware support on this, following any part of this article could lead to more complex situation if not ran by an expert.   Symptoms Datastore does not mount because of a lost or overwritten partition table.   Purpose When a VMFS partition is created in ESX 3.x or ESX 4.x, it has a Master Boot Record (MBR) partition map. The MBR is written to the first 512 B block (LBA0) and contains the information where the (VMFS) partition starts and ends. ESXi 5.0 introduced VMFS-5, which uses a GUID partition table (GPT) for new datastores. When a VMFS-3 partition is created in ESXi 5.x and is later updated to VMFS-5, the original partition map (MBR) is maintained. If the partition information of a VMFS datastore is deleted or overwritten (for example, by a Windows system with direct access to the same disks), it is impossible to determine if the partition map was GPT or MBR. The only time you can be sure that a GPT partition map was used is if th...
Post a Comment
Read more