How client (client authentication) be identified if enterprice CA is renew as new key?

Question

eg: client authentication used for wifi authen,
i have a situation that Sub CA is going to renew as new key (Root CA no change)
after renew the Sub CA as new key, how wifi client PC and Wifi controller implement?

1. if replace new Sub CA to wifi controller, seems client can not be identified by controller, since client cert signed by old Sub CA.
2. Web server (server authen) can push the Sub CA to client, i think it is OK, either server or client is new, vice versa

Answer 1

Hi,

Thank you for posting your query.

Kindly follow the steps provided below to resolve your issue.

Based on my research, there will be some difference when renew CA cert with the new key pair and existing key pair.

When you renew CA certificate with existing key pair, nothing important in certificate is changed. The certificate will contain the same public and private key. As the result all previously issued certificates will chain up to new CA cert without any changes.

When you renew CA certificate with new key pair, previously issued certs by old CA cert will chain up to previous CA cert and newly issued certs will chain up to new CA cert respectively.
For more information, you can refer to the following link: https://www.sysadmins.lv/blog-en/root-ca-certificate-renewal.aspx
This response contains a third-party link. We provide this link for easy reference. Microsoft cannot guarantee the validity of any information and content in this link.

Go to this link for your reference and other troubleshooting procedures https://learn.microsoft.com/answers/questions/394909/if-ent-ca-renew-with-new-key-does-client-know-to-c.html

Do not hesitate to message us if you need further assistance.

If the answer is helpful kindly click "Accept as Answer" and up vote it.