Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I recently setup Windows 2003 Certificate Services and installed a five year certificate. I'm now working with a vendor that requires our public CA key so that they can trust all certificates generated by us, but they will not accept it since the maximum length of certificates they'll accept are 3 years. Is there any way to shorten the length of the CA key?

share|improve this question
up vote 2 down vote accepted

Yes, but you'll have to reissue your CA certificate and deal with all the knock-on effects of that. Short of invalidating it, there is no way to reduce the validity period of a certificate, it's encoded at create time.

share|improve this answer
Yes, X509 doesn't have a mechanism of changing issued certificates. You can only invalidate published certificate. – Hubert Kario Oct 18 '10 at 21:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.