2

So shortly after configuring an offline root CA and online AD subordiante CA with SHA512 for future proofing. We discovered a thin client vender (teradici zero client with View 6) only supports SHA1 and SHA256.

I am not able to find ANY way configure a template to use SHA256 with any of the CSPs. I tried "certutil -setreg ca\csp\CNGHashAlgorithm 256" however that invalidates the signature for each new certificate generated.

Other than redoing the entire PKI, does anyone have any ideas or paths I can pursue?

Thanks.

1 Answer 1

1

I wouldn't say redoing, but you cannot change existing certificates, because they are digitally signed and any change will break digital signature. They will remain SHA512. Deal with it.

In your case you need to reissue and replace problematic certificates.

edit1: signature algorithm is server-wide. You cannot designate signature algorithm on template basis or something else.

p.s. in version 3 (and 4) certificate templates in Cryptography tab, you may find a signature algorithm setting. Don't be confused, this setting specifies only signature algorithm to sign request. Certificate will be signed with algorithm specified in CA settings.

2
  • I see your point on the existing certificates, but the real problem here is that the vendor is not able to accept SSL certificates with SHA512, which is used by the Certificate Authority. What I am asking: Is there any way to configure a template to issue a certificate with SHA256 instead of SHA512 as a one off?
    – Graham
    Jan 29, 2015 at 21:00
  • Nope. See my edited response.
    – Crypt32
    Jan 29, 2015 at 21:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .