Certificate Services

Question

I have a root CA which is Standalone and a subordinate CA which is part of domain. The certificate for both the root CA and sub CA are expiring on the same date and time. Is that the right configuration. If not what is the best praticse.

Answer 1

Both expiring at the same day is most likely the consequence of trying to issue an subordinate CA certificate with a validity date after the expiry date of the root CA. The Windows CA enforces the shell model of life time nesting, so the NotAfter date of
a certificate signed by a CA cannot be after the NotAfter date of the CA certificate.
If you have setup a Root CA with a certificate expiring in 10 years now and if you had configured the ValidityPeriod / ValidityPeriodUnits registry keys of the Root CA to something greater equal than 10 years, than the certificate of the Sub CA is "truncated"
so that its NotAfter date is before that of the Root CA.
I agree with Switch - normally you enforce nested lifetimes in the following way:
The certificate of the Sub CA is configured (via the reg keys configured at the Root CA) for being valid for half the validity period of the Root C, say 5 years
You renew the Root CA after half of the validity period.
Reason: At every point of time you could add another Sub CA whose validity period could extend to 5 years. Otherwise if both CA certificates expire at the same point of time AND you don't renew the Root CA in due time, the life time of any Sub CA setup close
to the expiry date of the Root CA would be truncated to less than 5 years.
In the same way you would - in a chain with a Root CA valid for 10 years and a Sub CA valid for 5 years - configure the reg key at the Sub CA for limiting the life time of end-entity certificates to 2,5 years; and you would renew the Sub CA after 2,5 years.
In this way you can be sure that at every point of time you will be able to issue, say, web server certificates with a life of 2,5 years.
So the whole point of this is to make sure that at every point of time you can create new certificates with a predictable maximum validity period. Renewal is important, because it is always the latest CA certificates that determines the maximum NotAfter
date of subordinate certificates. This strategy applies both to subordinate CAs and to end-entity certificates.
Elke