Deploy new certificates before revoking old ones

i'm deploying new ca.  during migration i'd make sure has new certs before revoke old ca's certs.  wanted make sure work.

i want make transition seemless of our users.  hoping "reenroll" new server without removing old ones.  work or maybe creating new template?

i not completelly sure want do:

say have oldca. has own signing oldcacert. , say, installing newca , understand using different newcacert signing new certificates.

and understand there users using certificates issued , signed oldcacert.

once revoke oldca, certificates signed oldcacert automatically invalid well. solution enroll users newca.

i go way:

a) install newca newcacert

b) remove certificate templates oldca

c) configure newca issue same templates oldca

d) select reenroll certificate holders on required certificate templates

e) leave oldca operational until either sure issued certificates expired or users have new alternative

f) consider whether must revoke oldcacert. think making crl publication interval long enough go on validity, published it and stop service.

ondrej.

Windows Server  >  Security