Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an offline root and am trying to constrain it using the EKUs so it doesn't have all application policies.

Most of this is trial and error and I"d like to make this more efficient rather than uninstalling reinstalling the subCA just to get a new certificate to get signed by the root.

How can I (using the commandline) reinstall the CA so that it will properly generate a new request file (to be processed by the root ca) and read the CaPolicy.inf and Policy.inf appropriately?

share|improve this question

Install the CA

Note this is one line and CRLF should be removed

Install-AdcsCertificationAuthority -Force -CAType "EnterpriseSubordinateCA" -CryptoProviderName "RSA#Microsoft Software Key Storage Provider" 
 -HashAlgorithmName "SHA1" -KeyLength "2048"
 -CADistinguishedNameSuffix "DC=FreeSMIME,DC=com" -CACommonName "Signing Policy1" 
 -OutputCertRequestFile "C:\" 
 -DatabaseDirectory "C:\Windows\system32\CertLog"
 -LogDirectory "C:\Windows\system32\CertLog"

Remove the CA

Uninstall-AdcsCertificationAuthority -Force

Source: the event log in Microsoft-Windows-CertificateServices-Deployment/Operational

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.