In our Windows Domain (2008R2 and 2012R2 Servers), we are running a Domain CA. The root certificate is a self-signed certificate.

We also have a x.509 certificate from our internet provider (mostly for our websites), signed by a trusted internet CA.

What i want to do is remove the self-signed root certificate from the Windows CA and replace it with the certificate from our provider.

Two questions: 1. is this even possible? Can i use a certificate from a trusted CA as root certificate for my own CA? 2. will this be possible without rebuiliding the whole domain? I think the domain controlers need the certificates for their LDAP communication, what will happen if i just switch the root certificate they used to create their own certificates?

Thanks for your help!

We also have a x.509 certificate from our internet provider (mostly for our websites), signed by a trusted internet CA.

Sorry this is usually not possible. There are basic constraints in X.509 certificate and one of them says if it can sign other certificates. Usually, CAs don't issue such certificates to non-CAs.

This is an example of a cert allowed to sign other certs:

cert allowed to sign other certs

This is an example of a normal cert - it's disallowed to sign other certs:

cert not allowed to sign other certs

I wouldn't worry about it. Virtually all public CAs have self-signed root certificates, so why shouldn't your private CA have a self-signed root too?

  • Which attribute would this be, and what value should it have? I found a field called "Base Constraints", with values "Subject Type=CA" and "Path Length Constraint=1". – Tobias Nov 23 '15 at 13:10
  • Yes, as you see in screenshots, this attribute will allow you to sign certficates properly. – kubanczyk Nov 23 '15 at 13:12
  • Your Edit and my comment just overlapped... We want to use a trusted certficate because we want to use s/MIME mail signing. If this is the wrong way to do it, please tell me... – Tobias Nov 23 '15 at 13:13
  • After i know now that our "external" root certificate can sign certificates - how can i add this external root certificat as root of my Windows Certificate chain? Or how can i "switch" the root certificate? – Tobias May 13 '16 at 12:58

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.