Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

does anybody know what will happen to encrypted /signed mails when a root authority certificate expires in my domain network? Can the certificate still be validated from the clients and will the clients recognize that the certificate was valid when the mail was encrypted / signed?

Respectively what will happen when a migration to a new infrastructure will take place or if I install a new root-CA? Is there a need to also migrate the expired root certificate?

share|improve this question

I can only speak for behavior in Outlook, but ... an expired certificate will give a warning when a user opens their e-mail saying it is untrusted. They can view the expired certificate and decide if they want to continue and read the e-mail.

It's like an expired ID card. I know it used to be you, but you could have changed your name or shaved your head or something ... so you need a new ID before I can validate your identity.

Regarding the migration ...

Certificate Authority Trust Model

"An expired CA certificate in the certification path does not invalidate the path. In the Windows 2000 public key infrastructure, a certification path can be valid as long as the CA certificate was valid at the time the certificate was issued. " So yes. You should probably keep the expired root cert.

share|improve this answer
Thanks for your answer, the problem is, when I don't keep my expired root certificate, the client can't check whether the certificate has ever been valid!? – Wolfgang Jun 20 '11 at 17:54… The top response suggests that you do keep the certificates for signature verification ... how it'd work you might have to do more digging for. – Daniel B. Jun 20 '11 at 23:47
I've updated the answer with a tidbit I found on technet that would suggest you should migrate the expired certificate. – Daniel B. Jun 20 '11 at 23:52
Thank you very much! The only question which still concerns me is how the users get their old crtificates when I migrate to a new PKI infrastructure. All users obviously need their certificates to decrypt their encrypted mails. But as far as I know the certificates are stored in active directory, are they? If not, how did the client certificates get saved? Only via client backup? – Wolfgang Jun 24 '11 at 15:04
I stuck some bad info in my (now deleted) last comment ... so here's this instead. You want to renew the user's expired certs and use the same private key; they shouldn't need to keep their old cert. I'm not sure how you would handle that if it's integrated with AD ... – Daniel B. Jun 24 '11 at 16:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.