2

I have an offline root and am trying to constrain it using the EKUs so it doesn't have all application policies.

Most of this is trial and error and I"d like to make this more efficient rather than uninstalling reinstalling the subCA just to get a new certificate to get signed by the root.

How can I (using the commandline) reinstall the CA so that it will properly generate a new request file (to be processed by the root ca) and read the CaPolicy.inf and Policy.inf appropriately?

1 Answer 1

1

Install the CA

Note this is one line and CRLF should be removed

Install-AdcsCertificationAuthority -Force -CAType "EnterpriseSubordinateCA" -CryptoProviderName "RSA#Microsoft Software Key Storage Provider" 
 -HashAlgorithmName "SHA1" -KeyLength "2048"
 -CADistinguishedNameSuffix "DC=FreeSMIME,DC=com" -CACommonName "Signing Policy1" 
 -OutputCertRequestFile "C:\SMIMEPOL01.ad.FreeSMIME.com_ad-SMIMEPOL01-CA-1.req" 
 -DatabaseDirectory "C:\Windows\system32\CertLog"
 -LogDirectory "C:\Windows\system32\CertLog"

Remove the CA

Uninstall-AdcsCertificationAuthority -Force

Source: the event log in Microsoft-Windows-CertificateServices-Deployment/Operational

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .