Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an offline root and am trying to constrain it using the EKUs so it doesn't have all application policies.

Most of this is trial and error and I"d like to make this more efficient rather than uninstalling reinstalling the subCA just to get a new certificate to get signed by the root.

How can I (using the commandline) reinstall the CA so that it will properly generate a new request file (to be processed by the root ca) and read the CaPolicy.inf and Policy.inf appropriately?

share|improve this question
add comment

1 Answer 1

Install the CA

Note this is one line and CRLF should be removed

Install-AdcsCertificationAuthority -Force -CAType "EnterpriseSubordinateCA" -CryptoProviderName "RSA#Microsoft Software Key Storage Provider" 
 -HashAlgorithmName "SHA1" -KeyLength "2048"
 -CADistinguishedNameSuffix "DC=FreeSMIME,DC=com" -CACommonName "Signing Policy1" 
 -OutputCertRequestFile "C:\SMIMEPOL01.ad.FreeSMIME.com_ad-SMIMEPOL01-CA-1.req" 
 -DatabaseDirectory "C:\Windows\system32\CertLog"
 -LogDirectory "C:\Windows\system32\CertLog"

Remove the CA

Uninstall-AdcsCertificationAuthority -Force

Source: the event log in Microsoft-Windows-CertificateServices-Deployment/Operational

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.