3

I cannot make my Enterprise Root CA issue certificates with an expiration date more than 2 years.

I've already set ValidityPeriodUnits and ValidityPeriod register keys with certutil.exe.

I've already duplicated my template in order to encrease the validity period.

My RootCA certificate expires on 2035 and is version 3.

Improve this question

3 Answers 3

Reset to default
2

strongline is right, I think. You should launch the certificate templates MMC snapin on your CA server and make a copy of the certificate template that you are using. Then, modify the copy to use the desired settings, such as the cert lifetime.

Improve this answer
6
  • Isn't that what Fabio Bombardi already tried? He states his root certificate expires in 20y...
    – Lenniey
    May 6, 2015 at 14:27
  • @Lenniey, you are mixing up root CA cert and the certs that this root CA issues.
    – strongline
    May 6, 2015 at 17:00
  • @strongline but he does write: I've already duplicated my template in order to encrease the validity period. Isn't that what you told him to do? Maybe I'm confusing things here
    – Lenniey
    May 7, 2015 at 6:57
  • @Lenniey For whatever reason, I missed that statement. My bad. But there is still possibililty that Fabio duplicate the wrong template, otherwise it can't explain why he shouldn't be able to issue certs that is as long as what template defines.
    – strongline
    May 7, 2015 at 12:33
  • Thanks guys. With inetmgr I cannot issue a domain certificate of validity of 20 years even if I've duplicate my Web Server template changing it's expiration time. With the certsrv WebServer (localhost/certsrv) I'm able to create a certificate using the duplicated template but this certificate doesn't have a private key so that I cannot convert it ina pfx (p12) cert and using it in my website for TSL (SSL).
    – shadowsheep
    May 11, 2015 at 10:35
1

You cannot issue certs whose expiry date is longer than what its template defines. You need to change your certificate template.

Improve this answer
0

Thanks guys. With inetmgr I cannot issue a domain certificate of validity of 20 years even if I've duplicate my Web Server template changing it's expiration time. With the certsrv WebServe I'm able to create a certificate using the duplicated template but this certificate doesn't have a private key so that I cannot convert it ina pfx (p12) cert and using it in my website for TSL (SSL).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .