Offline ROOT CA - Can I simply roll out a new one to use for Subordinate request signing?

Heath Durrett 486 Reputation points
2020-08-25T12:06:13.59+00:00

Hi All,

After running low on resources in one of our VM environments a script was run to identify all offline VMs and delete them. This deleted my "Offline ROOT CA" servers in that environment.

My basic understanding of the two tier online / offline model is that this is not really a problem at all until it comes time to re-issue my "Online Subordinate CA" certificate...which is still 4Yrs 9Mnths away.

My question is this...when that time comes...

Can I simply roll out a new VM with the same name, IP Address and CDP / AIA configuration and carry on as though nothing happened?

Create a new REQ file on the Online Subordinate, Issue it that REQ on the rebuilt Offline ROOT, complete the REQ on the Online Subordinate and carry on as though nothing has happened?

What happens to the CRL in terms of the expired ROOT CA cert?

Can I simply script the deletion of that expired ROOT CA cert on my servers and carry on - business as usual?

Thanks in advance,
durrie.

Windows Server Security
Windows Server Security
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
1,774 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Vadims Podāns 9,116 Reputation points MVP
    2020-08-25T12:32:38.573+00:00

    Can I simply roll out a new VM with the same name, IP Address and CDP / AIA configuration and carry on as though nothing happened?

    these property matching is not necessary, since they won't replace dead root CA. Essentially, you have to rebuild new root CA, deploy it to all clients and then renew issuing CA certificate.

    Create a new REQ file on the Online Subordinate, Issue it that REQ on the rebuilt Offline ROOT, complete the REQ on the Online Subordinate and carry on as though nothing has happened?

    this is the way to go. However, at some point, issuing CA will notice that one of previous certificates cannot be validated because of expired CRL. You can't renew CRL for deleted CA. But you don't need to rebuild issuing CA completely, just renew its certificate. I would suggest to renew all client certificates after renewing issuing CA, so all active and in use certificates chain up to new and existing root CA.

    Can I simply script the deletion of that expired ROOT CA cert on my servers and carry on - business as usual?

    yes. But you do that only when new offline Root CA is completely deployed.

    0 comments