新聞財經娛樂♬資訊 News Economy

When renewing the certificate for the Subordinate CA, it is only for 1 year but when I look at the template it is for 5 years.

Is there a way to resolve this so it has 5 years?
 Can i make it longer than 5 years?

I think, the only way to change subordinate CA validity is to duplicate existing version 1 template named 'Subordinate Certification Authority' and create custom version 2 or 3 template with custom validity settings. Do not forget to add this template to Issuing Template list on issuer.

Since subordinate CA hardcodes default template name it is necessary to create (or edit existing) CAPolicy.inf on subordinate CA by adding the following line to [RequestAttributes] section:

[Version]
Signature = "$Windows NT$"

[RequestAttributes]
CertificateTemplate = "CustomTemplateCommonName"


This setting will enforce CA server to use custom template information instead of default template. Now you can setup new Enterprise Subordinate CA and use custom template that defines extended validity for SubCA certificate.

---------------------------------------------------------------------------------
Original Source:
http://en-us.sysadmins.lv/Lists/Posts/Post.aspx?ID=50
Check "Issuer is Enterprise CA" section in above post.
In the post they have mentioned that you need to increase issuer certificate validity as well which is not required in your case as your root CA validity period is upto 2062

Request you to please take mentioned steps above an check

Thanks
Mahesh