3

I cannot make my Enterprise Root CA issue certificates with an expiration date more than 2 years.

I've already set ValidityPeriodUnits and ValidityPeriod register keys with certutil.exe.

I've already duplicated my template in order to encrease the validity period.

My RootCA certificate expires on 2035 and is version 3.

2

strongline is right, I think. You should launch the certificate templates MMC snapin on your CA server and make a copy of the certificate template that you are using. Then, modify the copy to use the desired settings, such as the cert lifetime.

  • Isn't that what Fabio Bombardi already tried? He states his root certificate expires in 20y... – Lenniey May 6 '15 at 14:27
  • @Lenniey, you are mixing up root CA cert and the certs that this root CA issues. – strongline May 6 '15 at 17:00
  • @strongline but he does write: I've already duplicated my template in order to encrease the validity period. Isn't that what you told him to do? Maybe I'm confusing things here – Lenniey May 7 '15 at 6:57
  • @Lenniey For whatever reason, I missed that statement. My bad. But there is still possibililty that Fabio duplicate the wrong template, otherwise it can't explain why he shouldn't be able to issue certs that is as long as what template defines. – strongline May 7 '15 at 12:33
  • Thanks guys. With inetmgr I cannot issue a domain certificate of validity of 20 years even if I've duplicate my Web Server template changing it's expiration time. With the certsrv WebServer (localhost/certsrv) I'm able to create a certificate using the duplicated template but this certificate doesn't have a private key so that I cannot convert it ina pfx (p12) cert and using it in my website for TSL (SSL). – shadowsheep May 11 '15 at 10:35
1

You cannot issue certs whose expiry date is longer than what its template defines. You need to change your certificate template.

0

Thanks guys. With inetmgr I cannot issue a domain certificate of validity of 20 years even if I've duplicate my Web Server template changing it's expiration time. With the certsrv WebServe I'm able to create a certificate using the duplicated template but this certificate doesn't have a private key so that I cannot convert it ina pfx (p12) cert and using it in my website for TSL (SSL).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.