1

How can I set in ADCS the validity period for certificates which are issued by my sub-CA based on a Computer certificate template? Right now, my certificates are issued for one year only.

If I open the properties of the certificate template, it only shows some basic info and nothing can be changed.

Improve this question

1 Answer 1

Reset to default
1

A certificate is issued for the lower of either:

  • The CA's ValidityPeriod and ValidityPeriodUnit registry values, or
  • The value in the template.

As the Computer template is version 1 schema, you cannot change its validity. However, it's considered wiser to copy the template and use the copy for enrollments. When you copy, you can set additional values and the schema will be upgraded accordingly. That is, you'll end up with a version 2, 3, or 4 schema template. That's not a problem unless you're using a really old version of Windows.

Improve this answer
2
  • Thank you for your help! So you mean, create a copy of this and then I will be able to modify settings on the copy (and thus get upgraded to a newer schema version) and then I can edit GPO to use that template?
    – Kristof Rado
    Sep 18 at 20:09
  • That's correct. The recommendation is to leave the default templates alone and only modify copies.
    – garethTheRed
    Sep 18 at 20:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .