A question about ValidityPeriodUnits and ValidityPeriod

hello all

can please me following question.

i understand above can set in capolicy.inf file when building ca or post build using certutil e.g.

certutil -setreg ca\validityperiodunits 5 

certutil -setreg ca\validityperiod "years"

so understand if in capolicy.inf file sets notafter date of ca certificate (e.g. ca cert last 5 years in above example).

i assume when used via certutil (on built ca) can used further limit maximum notafter date of certs ca issues.

for example if ca cert set 10 years (via above settings in capolicy.inf file), , want limit certs issued ca maximum of 5 years (rather 10 years) set registry value above.

are assumptions above correct?

if case limit maximum notafter date of certs issued via templates (e.g. enterprise joined ca) or non-enterprise (standalone) ca's. example if ca cert 10 years , create copy of webserver template , adjusted period 5 years, set above registry values 3 years (restarted services) maximum age of webserver cert 3 years despite fact template says 5 because of registry key?

thanks all

aanotheruser__

---

aanotheruser__

on thu, 12 mar 2015 14:40:04 +0000, aanotheruser wrote:

can please me following question.

understand above can set in capolicy.inf file when building ca or post build using certutil e.g.

certutil -setreg ca\validityperiodunits 5 

certutil -setreg ca\validityperiod "years"

understand if in capolicy.inf file sets notafter date of ca certificate (e.g. ca cert last 5 years in above example).

assume when used via certutil (on built ca) can used further limit maximum notafter date of certs ca issues.

example if ca cert set 10 years (via above settings in capolicy.inf file), , want limit certs issued ca maximum of 5 years (rather 10 years) set registry value above.

assumptions above correct?

no, not correct. using capolicy.inf or certutil both exactly
same thing. both set these values in registry of ca which
in turn has impact on certificates ca issues. have no
impact on lifetime of ca certificate itself. in case of subca
lifetime of ca cert determined parent ca issues its
cert. in case of root ca lifetime of cert determined when
running configuration wizard.

if case limit maximum notafter date of certs issued via templates (e.g. enterprise joined ca) or non-enterprise (standalone) ca's. example if ca cert 10 years , create copy of webserver template , adjusted period 5 years, set above registry values 3 years (restarted services) maximum age of webserver cert 3 years despite fact template says 5 because of registry key?

in case of enterprise ca, maximum lifetime of certificate is
determined by:

1. registry entries validityperiod , validityperiodunits.
2. certificate template values.
3. remaining lifetime of ca cert itself.

the maximum lifetime shorter of above values.

---

paul adare - fim cm mvp
aim please. ourselves, mostly, aim please. -- a. deboer

Windows Server  >  Security