Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a client that is using self-signed certificates (to sign InfoPath forms). The certificates are created using the certificate service built into Windows 2008. They said the certicates always expire after one year. How does one chage the expiration date on a certificate or do they have to issue new ones? (Is one year the default in the template)?

I think the only tools available to them are the ones windows comes with: certmgr, certutil, & certreq. (Am I missing any?)

Also, The certificate is a Code Signing Certificate, if that makes a difference?

share|improve this question
up vote 2 down vote accepted

There is a Microsoft Knowledge Base article about this question:

How to change the expiration date of certificates that are issued by a Windows Server 2003 or a Windows 2000 Server Certificate Authority

You can't change the expiration date of an existing certificate. But you can change the default validity period for the Certificate Authority.

This article describes how to change the validity period of a certificate that is issued by a Windows Server 2003 or a Windows 2000 Server Certificate Authority (CA).

By default, the lifetime of a certificate that is issued by a Stand-alone Certificate Authority CA is one year. After one year, the certificate expires and is not trusted for use. There may be situations when you have to override the default expiration date for certificates that are issued by an intermediate or an issuing CA.


A CA cannot issue a certificate with a longer validity period than its own CA certificate.

share|improve this answer

In general you can't change an expiry on an existing cert. You can possibly reissue a new one with a new expiry date (possibly more than a year in the future, depending on your tools, of course), but you can't change one that's already been issued.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.