Enterprise Subordinate Certificate Authority Validity Period

[AlanW.]

We have recently implemented a two tier Certificate Authority
infrastructure.
Our Root Certificate has a validity period of 20 years. This is what
we wanted.

I am now in the process of trying to generate our Subordinate CA
Certificate. The validity period, I believe, is being pulled from the
Certificate Template on the Root CA, and is generating a validity
period of 5 years. I cannot seem to find a way to change this.
I have tried tinkering with the CAPolicy.inf file, but the settings
seem to be ignored.
Our current CAPolicy.inf file is located at C:\Windows on both our
root and Subordinate CA.
The contents are below:

[Version]
Signature= "$Windows NT$"
[Certsrv_Server]
RenewalKeyLength=4096
RenewalValidityPeriod=Years
RenewalValidityPeriodUnits=20
[CRLDistributionPoint]
[AuthorityInformationAccess]

All I need the Policy to do is extend the validity period of our
Subordinate CA certificate from 5 to 20 (or even 15 or 10) years.

I do not seem to be having much success with this.
Thanks for any assistance.

[AlanW.]

I have resolved this issue.
The solution was a combination of Root CA Templates and Subordinate
CAPolicy.inf file.

I needed to create new certificate Template on my root CA, since the
Subordinate was selecting the SubCA Template by default.
Once I created a new Template with a longer validity period, I
modified the CAPolicy.inf file on the Subordinate CA

The Subordinate Template's CAPolicy.inf file needs to have:

[RequestAttributes]
CertificateTemplate = <your custom SubCA template>

Thanks!

[Jorge Silva]

Hi
Also note that the defaults (For all CERTs) can be changed by using:
certutil -setreg CA\ValidityPeriodUnits 10
certutil -setreg CA\ValidityPeriod "Years"
These values can also be changed at:
HKLM-SYSTEM-CurrentControlSet-Services-CertSrv-Configuration-CAName
ValidityPeriod
ValidityPeriodUnits
--
I hope that the information above helps you.
Have a Nice day.

Jorge Silva
MVP Directory Services

Please no e-mails, any questions should be posted in the NewsGroup
This posting is provided "AS IS" with no warranties, and confers no rights.

Post by AlanW.
I have resolved this issue.
The solution was a combination of Root CA Templates and Subordinate
CAPolicy.inf file.
I needed to create new certificate Template on my root CA, since the
Subordinate was selecting the SubCA Template by default.
Once I created a new Template with a longer validity period, I
modified the CAPolicy.inf file on the Subordinate CA
[RequestAttributes]
CertificateTemplate = <your custom SubCA template>
Thanks!