3

I am wonder what will happen as a certificate template with a 2 years validity period (for example) will issue a certificate when the CA certificate expires in 1 year.

I can think of 2 things that could possible happen, but this is just guessing, thats why I would like to know. I think possibly the following will happen:

  • You can a notification of some sort.
  • The issued certificate will get an expiration date of 1 year, not 2.

Can anyone tell me what will happen?

kevin rennenberg
  • 73
  • 11
  • @bodgit This question is not a duplicate of the link you provided. – Crypt32 Feb 19 '19 at 16:32
  • Sure it is. It covers that actually there's nothing to stop you creating a certificate with a validity longer than the signing CA, and also how to keep things running should/if/when the CA expires. – bodgit Feb 19 '19 at 16:34
  • The link talks about whatever else (OpenVPN, OpenSSL) but the subject in this question. – Crypt32 Feb 19 '19 at 16:49

1 Answers1

3

The issued certificate will get an expiration date of 1 year, not 2.

this is correct answer. ADCS will sign the certificate, however issued certificate's validity will not exceed the CA certificate validity and limited only to 1 year.

To avoid this, you should renew CA certificate in advance. At the best -- X years prior to CA certificate expiration, where X is the longest validity period specified in operational certificate template settings. That is, if the longest validity provided by any operational template is 3 years, you should renew CA certificate 3 years prior to its expiration (and so on).

Another point to consider: always renew CA certificate with *NEW* key pair. This will ensure that any client will build only one certification path during chain building. Otherwise you may run into issues when wrong (expired) chain is selected when better alternatives exist. Do not reuse CA keys.

Crypt32
  • 6,414
  • 1
  • 13
  • 32
  • Thanks! I know it is best practice to renew in advance but I just wanted to know in case the responsible party would forget to renew it. – kevin rennenberg Feb 21 '19 at 11:43
  • This is software dependent, though. Other CAs may issue certificates with longer lifetime, though it's not recommended. – Jenny D Feb 22 '19 at 08:51
  • I believe the question was specific to ADCS implementation. `Other CAs may issue certificates with longer lifetime` -- not RFC3280/RFC5280 compliant. – Crypt32 Feb 22 '19 at 11:24
  • Yes it was specific to ADCS, however I did not specifically mention this, sorry! – kevin rennenberg Feb 25 '19 at 10:58