Friday, February 18, 2011

How to set certificate lifetime on a standalone CA

When you install a Microsoft Certificate Server - standalone version it defaults to only issue certificates that are valid for one year. In Windows 2008 R2 there are no templates on a standalone server so you can not change this easily.
I have found two ways to change this.

  1. Prior to installing the root standalone certificate server, create a CAPolicy.inf file, as described here. This option lets you do lots of changes to the root certificate like issuing legal policies and so on. Read the article and decide.
  2. On the server, after you have installed the AD CS, you can run the command "certutil -setreg CA\ValidityPeriodUnits 5", and you have changed the lifetime to 5 years.
Good luck :)

Labels:

0 Comments:

Post a Comment

Links to this post:

Create a Link

<< Home