Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I recently setup Windows 2003 Certificate Services and installed a five year certificate. I'm now working with a vendor that requires our public CA key so that they can trust all certificates generated by us, but they will not accept it since the maximum length of certificates they'll accept are 3 years. Is there any way to shorten the length of the CA key?

share|improve this question
add comment

1 Answer 1

up vote 2 down vote accepted

Yes, but you'll have to reissue your CA certificate and deal with all the knock-on effects of that. Short of invalidating it, there is no way to reduce the validity period of a certificate, it's encoded at create time.

share|improve this answer
1  
Yes, X509 doesn't have a mechanism of changing issued certificates. You can only invalidate published certificate. –  Hubert Kario Oct 18 '10 at 21:04
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.