3

We are using self-signed certificates for internal development machines and other internal connection encryption.

The certificates were created using Microsoft Certificate Server.

I need to move the certificate server from an old DC to a new DC, I am wondering how long the certificate server can be unavailable before the certificate cannot be verified and connections begin to fail.

I don't believe it is immediate, but I don't recall for sure.

1 Answer 1

7

Certificates will begin to fail validation once the published Certificate Revocation List (or Delta CRL, if they're in use) expires or is inaccessible (make sure that not all of your distribution points are on the CA itself). This will depend completely on your configuration, and may be anywhere from under an hour to several months.

The Enterprise PKI snap-in (pkiview.msc) is a good resource for checking the status and expiration times of your CRLs, and you can check their configured lifetimes on the CA.

For the standard CRL:

certutil -getreg ca\crlperiodunits
certutil -getreg ca\crlperiod

And the delta:

certutil -getreg ca\crldeltaperiodunits
certutil -getreg ca\crldeltaperiod
7
  • 2
    You can also disable CRLs, so it's possible the answer is 'never'.
    – Chris S
    Jan 9, 2012 at 21:09
  • @Chris S, Is that a smart thing to do though?
    – Brettski
    Jan 9, 2012 at 21:16
  • 3
    No. The answer then is "when the certificates expire". having a CA "off" is standard for enterprise roots (certify a sub-ca, then turn off the root ca). But the issued certificates also have an expiration date....
    – TomTom
    Jan 9, 2012 at 21:17
  • 1
    @Brettski You'd only want to not use CRLs if there's no expectation of ever having to revoke a certificate for any reason. This is not the case in most deployments, it makes sense in some specific cases. Jan 9, 2012 at 21:19
  • pkiview was not located on my server. I was able to use certutil to discover a clr period of one week and delta of one day. Thank you for the information.
    – Brettski
    Jan 9, 2012 at 21:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .