Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The certificates my Microsoft CA is generating do not match the time period indicated in the template used. How can I resolve this?

I recently created a new certificate template for use on my Linux boxes on my Microsoft CA (2008 R2 Enterprise). This template is approved for server and client authentication purposes with a validity period of 10 years - the expected lifetime of our Linux boxes - and the subject name supplied in the request. I have checked both the intermediate and offline CA - both have more than 10 years of life listed. The certificates are exactly two years.

Is there some kind of hard limit I'm hitting here?

share|improve this question
What validity lifetime are they getting instead of 10 years? – Shane Madden Sep 20 '12 at 23:49
@ShaneMadden added. – Tim Brigham Sep 21 '12 at 0:52
up vote 7 down vote accepted

By default ADCS is set to issue certs for a maximum of 2 years (regardless of template or request).
To change that just run the following two commands (modify as desired):

certutil -setreg CA\ValidityPeriod "Years"
certutil -setreg CA\ValidityPeriodUnits 10

Then restart certificate services:

net stop  certsvc
net start certsvc
share|improve this answer
Ugh.. thanks. Did that on the offline CA but likely forgot it on the intermediate. – Tim Brigham Sep 21 '12 at 1:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.