2

I'm trying to install a subordinate CA with Microsoft ADCS and when I do, it creates a .req file. Then I use that at the root CA to issue a certificate. The resulting certificate is always for 5 years. I want it to be 10. I have tried setting ValidityPeriod=Years and ValidityPeriodUnits=10 in the CAPolicy.inf file on the subordinate CA. And I have tried various other things, but nothing seems to make any difference. The installation command I'm using is:

Install-AdcsCertificationAuthority -CAType EnterpriseSubordinateCA -CACommonName "IssuingCA" -KeyLength 2048 -HashAlgorithm SHA256 -CryptoProviderName "RSA#Microsoft Software Key Storage Provider"

I uninstalled and tried to reinstall with -ValidityPeriod years -ValidityPeriodUnits 10 in the command, but got an error: Install-AdcsCertificationAuthority : Property cannot be modified in current state of object. Current CA Type does not allow this property to be modified. Two or more parameter values specified for a resource's properties are in conflict. 0x80071709 (WIN32: 5897 ERROR_CLUSTER_PARAMETER_MISMATCH)

Does anyone else know how to do this?

2
  • how long is valid your root CA? Is your root CA running Microsoft CA, or 3rd party? If it is Microsoft CA, what type it is, Standalone or Enterprise?
    – Crypt32
    Mar 17, 2022 at 7:27
  • The root CA is Microsoft standalone (offline) root. I was able to get it to do 20 years apparently by setting the CAPolicy.inf RenewalValidityPeriod settings.
    – Roman
    Mar 17, 2022 at 18:07

1 Answer 1

2

You cannot set the ValidityPeriod and ValidityPeriodUnits arguments when installing a new Enterprise Subordinate CA. This is instead done by modifying the policy on the root CA by utilizing the following commands:

certutil -setreg ca\ValidityPeriodUnits 10
certutil -setreg ca\ValidityPeriod Years

Don't forget to restart the CertSrv service after. You can then issue the issuing CA certificate and it will be valid for 10 years, as long as your root CA is valid for longer than that.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .