5

Set up a Enterprise CA for Windows 2012. While generating the initial root CA, SHA512 was selected. This has proven to cause issues with TLS 1.2 that we were unaware of.

I'm trying to generate a new self-signed CA that isn't SHA512. The only options and instructions I can find are for renewing the existing CA which doesn't change the certificate type.

Is there a process for doing this or does CA Services have to removed and reinstalled to generate a new CA?

2
  • As far as I know, you have to start over again. I had to do that with my own install because our Sonicwall doesn't like non-sha1 certificates...
    – Nathan C
    Nov 26, 2014 at 19:00
  • Did you just remove the CA service and it cleared out all of the old certs? Or is there clean-up that has to occur to get the old certs out of AD?
    – lmickh
    Nov 26, 2014 at 19:14

1 Answer 1

5

Actually, you don't need to remove CA role or start over. You can simply renew CA certificate with new key pair. Before this procedure you need to make the following changes on CA server:

certutil -setreg ca\csp\cnghashalgorithm sha256
net stop certsvc && net start certsvc

and renew CA certificate. During prompt select to generate a new key pair.

2
  • Updated the value and renewed the certificate with a new pair. It updated the certificate server as expected, but now the DCs and servers are not pulling it down as a CA. Still only has the old SHA512 CA certs even after rebooting. Any suggestions?
    – lmickh
    Nov 26, 2014 at 21:21
  • I resolved the CA not updating with a gpupdate /force on the servers lacking the CA cert.
    – lmickh
    Nov 26, 2014 at 21:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .