Windows CA - Best Practices - Expirationdate,..

ErazerMe 46 Reputation points
2020-08-05T14:11:36.967+00:00

Hello all,

as mentioned in many news-tickers, the most common browser (chrome, firefox, safari,..) will only accept certificates with a maximum lifetime of 1 year.
This also means, that we have to replace all internally used webserver certificated with the new certificate expiration.

Is there a best-practice for all the certificate template settings? Which expiration should I use for which template?
Webserver - 1 year, user certificate - 2 year?
Is there any official documentation from microsoft or the browser-forum where all the topics are mentioned?

Second question:
How do other handles the certificate replacement?
Of course, for normal microsoft application like IIS this is no problem (rightclick - renew certificate, finish). But in other applications like tomcat, apache or whatever its not that easy. There got a certificate request from the according application-responsible and provided the certificate back. There is no possibilty to just replace/renew the already imported certificate. I think its a very time comsumed process?

Thanks for any help

Windows Server Security
Windows Server Security
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
1,774 questions

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Daisy Zhou 20,791 Reputation points Microsoft Vendor
    2020-08-06T02:54:08.797+00:00

    Hello AndyMeboldt,

    Thank you for posting in our Q&A forum.

    Here are the answers for your references.

    Q1: Is there a best-practice for all the certificate template settings? Which expiration should I use for which template?
    Webserver - 1 year, user certificate - 2 year?
    A1: we can set the validity period on certificate template depending on your requirements.

    However, the issued certificate validity period depends upon least value of below.

    1)The expiry date of issuing CA certificate.

    2)The validity period that is defined in the registry affects all certificates that are issued by Stand-alone and
    Enterprise CA. For Enterprise CA, the default registry setting is two years.
    For Stand-alone CA, the default registry setting is one year.
    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\CertSvc\Configuration\<CAName>\ValidityPeriodUnits

    3)The template validity period in case of Enterprise (AD integrated) CA.

    For example:

    The validity period of issuing CA certificate is 10 years, but the remaining time for issuing CA certificate is one month;
    The validity period on one certificate template is 5 years;
    The validity period that is defined in the registry affects all certificates that are issued by Enterprise CA is 6 years;
    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\CertSvc\Configuration\<CAName>\ValidityPeriodUnits

    If we enroll one certificate using the certificate template above, this issued certificate validity period is only one month.
    Or if we renew other certificates (assume validity period of certificate template is at least one year ), and validity period of the renewed certificates is one month.

    Q2: Is there any official documentation from microsoft or the browser-forum where all the topics are mentioned?
    A2: No, there is no such document.

    Q3: How do other handles the certificate replacement?
    A3: Usually, if we have internal CA server (with AD CS role), we can renew certificates issued by CA server based on the following three methods:
    1.Renew certificates by right clicking certificate\All Tasks\renew certificate with new key or advanced operations\renew this certificate with the same key.
    15920-ren1.png

    2.Renew certificate with GPO, if we configure autoenroll permission on certificate template and configure GPO with autoenroll setting

    Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies >Certificates Services Client – Auto-Enrollment
    Or
    User Configuration > Policies > Windows Settings > Security Settings >Public Key Policies > Certificate Services Client – Auto-Enrollment
    15966-ren2.png

    3.Request new certificate and replace the old certificates using new certificates.

    References:
    CA Validity Period Extension and CA Certificate Renewal Process
    https://www.experts-exchange.com/articles/32336/CA-Validity-Period-Extension-and-CA-Certificate-Renewal-Process.html

    Recommendations for PKI Key Lengths and Validity Periods with Configuration Manager
    https://techcommunity.microsoft.com/t5/configuration-manager-archive/recommendations-for-pki-key-lengths-and-validity-periods-with/ba-p/272758

    Best Regards,
    Daisy Zhou

    1 person found this answer helpful.
    0 comments
  2. Vadims Podāns 9,116 Reputation points MVP
    2020-08-05T15:59:42.01+00:00

    Which expiration should I use for which template?

    It's solely up to you, your requirements. It's ok to have 1yr server and 2yr client certificates.

    Is there any official documentation from microsoft or the browser-forum where all the topics are mentioned?

    no, there is no such documentation, nor best practices. Certificate validity is tied only to your and application requirements.

    How do other handles the certificate replacement?

    it is up to particular application. Every application has its own certificate provisioning/renewal process and there is no universal answer. Consult with particular applicaton's documentation for their renewal processes.

    0 comments