Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are using self-signed certificates for internal development machines and other internal connection encryption.

The certificates were created using Microsoft Certificate Server.

I need to move the certificate server from an old DC to a new DC, I am wondering how long the certificate server can be unavailable before the certificate cannot be verified and connections begin to fail.

I don't believe it is immediate, but I don't recall for sure.

share|improve this question
up vote 6 down vote accepted

Certificates will begin to fail validation once the published Certificate Revocation List (or Delta CRL, if they're in use) expires or is inaccessible (make sure that not all of your distribution points are on the CA itself). This will depend completely on your configuration, and may be anywhere from under an hour to several months.

The Enterprise PKI snap-in (pkiview.msc) is a good resource for checking the status and expiration times of your CRLs, and you can check their configured lifetimes on the CA.

For the standard CRL:

certutil -getreg ca\crlperiodunits
certutil -getreg ca\crlperiod

And the delta:

certutil -getreg ca\crldeltaperiodunits
certutil -getreg ca\crldeltaperiod
share|improve this answer
You can also disable CRLs, so it's possible the answer is 'never'. – Chris S Jan 9 '12 at 21:09
@Chris S, Is that a smart thing to do though? – Brettski Jan 9 '12 at 21:16
No. The answer then is "when the certificates expire". having a CA "off" is standard for enterprise roots (certify a sub-ca, then turn off the root ca). But the issued certificates also have an expiration date.... – TomTom Jan 9 '12 at 21:17
@Brettski You'd only want to not use CRLs if there's no expectation of ever having to revoke a certificate for any reason. This is not the case in most deployments, it makes sense in some specific cases. – Shane Madden Jan 9 '12 at 21:19
pkiview was not located on my server. I was able to use certutil to discover a clr period of one week and delta of one day. Thank you for the information. – Brettski Jan 9 '12 at 21:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.