|
Posted by Brian Komar \(MVP\) on February 27, 2008, 8:18 pm
Please log in for more thread options Answers inline...
> Thank you Brian.
>
> What's the correct sequence to follow? Do I :
> 1. Uninstall CS on the "root-to-be-demoted". then
> 2. Reinstall CS on same machine, selecting as an EntSubCA, then
> 3. Run "certutil -dcinfo deleteall" ?
This would be the correct order.
> Or do I run the deleteall before uninstalling CS?
Nope, since this instigates a re-enrollment. Wait until you have your subca
available.
>
> Can I control which CA will issue the new DC certs?
You should publish the Domain Controller and Domain Controller
Authentication certs at the subCA only.
> I'd prefer they come off the new SubCA, rather than the single RootCA that
> is to remain (ie subs do all the issuing).
Following best practices, the root CA would be an offline, standalone CA and
would never be on the network to issue DC certs
>
> Thanks again,
> Cam
>
>
> "Brian Komar (MVP)" wrote:
>
>> You will have to reinstall and replace the DC certificates.
>> But, this is easy.
>> certutil -dcinfo deletebad
>> (after the last CRL is expired)
>> Alternatively, run "certutil -dcinfo deleteall"
>> This will cause all DCs in the domain to replace their DC cert with an
>> updated certificate
>> Brian
>>
>> > With my limited understanding of Certificate Services (until now -
>> > hopefully
>> > I'm learning!), I realize that sometime in the past I have created
>> > multiple
>> > Enterprise Root CAs in the organisation. I have now read that this is
>> > OK,
>> > but not desirable.
>> >
>> > I'd like now to demote one rootCA back to an Ent Subordinate CA and
>> > retain
>> > a
>> > single RootCA, and I'm guessing this is going to involve uninstalling
>> > CertSvc
>> > and reinstalling on the machine being "demoted".
>> >
>> > My big concern is the existing certs that have already been issued by
>> > that
>> > CA - apart from it's own, it has issued Dom Controller certs for
>> > another 4
>> > DCs.
>> >
>> > How best can I handle this?
>> > Can I uninstall/reinstall CertSvc without affecting the DCs who have
>> > certs
>> > issued by this machine?
>> >
>> > Any help would be much appreciated,
>> > Cam
>>
>>
| 
XML Sitemap