|
Posted by manishjhanji on April 26, 2006, 4:14 am
Please log in for more thread options Brain,
Thanks for the information. We are currently using Certificates for
EAP-TLS. Is it possible to renew just the root CA and still ensure that
we could achieve authentication between two machines, one having
certificate issued with old root CA certificate and another having a
certificate issue with new root CA certificate? The link
http://72.14.203.104/search?q=cache:ImEb8-8XddAJ:www.microsoft.com/WINDOWS2000/techinfo/administration/security/certutil.asp+Does+Microsoft+CA+root+certificate+renew+required+clients&hl=en&gl=us&ct=clnk&cd=2
talks about "Enable Chaining Through Renewed CA Certificates". Could
we achieve the above points using this stuff?
Any help would be appreciated.
Regards,
Manish Jhanji
Brian wrote:
> Some answers inline...
>
> manishjhanji@gmail.com says...
> > Hi,
> >
> > We have a Windows 2000 root CA which would be expiring in next few
> > months. I understand that we can renew the root CA by following the
> > steps mentioned at
> >
http://www.microsoft.com/technet/prodtechnol/windows2000serv/technologies/iis/maintain/featusability/c06iis.mspx
> > section "Reviewing and Renewing the Root CA Certificate".
> >
> > Is there any option by which following could be achieved-
> > 1) The certificates assigned to the users can be renewed automatically
> > for the same duration as Root CA?
> Not with a Windows 2000 CA. Autoenrollment is only available when you
> have a Windows Server 2003 enterprise CA running on Windows Server 2003,
> enterprise edition. As well, the validity period of the certificates
> issued by a CA is limited by several factors:
> - Remaining validity period of the CA's certificate
> - Values of the ValidityPeriodUnits and ValidityPeriod in the registry
> - Lifetime configured for a certificate template (which in your case,
> you cannot change as it is a Windows 2000 CA that only issue v1
> certificate templates which cannot be editied.
>
> > 2) The Updated Personal & Root certificates be pushed to user
> > desktops?
> You cannot automatically push personal certificates unless you develop a
> script to automate enrollment. The root certificate will automatically
> publish into AD (if it is an enterprise CA), or can be published into AD
> using certutil from a Windows XP workstation.
>
> Brian
>
> >
> > Will appreciate any help.
> >
> > Regards,
> > Manish Jhanji
> >
> >
| 
XML Sitemap