Purpose and impact of CA Exchange certificate in a PKI environment

Question

Good morning everyone,

I set up an OCSP in a 2-tiers PKI infrastructure :

The OCSP is in error in pkiview.msc. To get it "green" in pkiview.msc, I had to delete and recreate the CA Exchange certificate (certutil -cainfo xchg).

• Is it normal ? (I mean, the usual way to do).
• Should I watch any side effect on the PKI when I delete and recreate this CA Exchange certificate ?
• What is the purpose of this CA Exchange certificate ? I understand it is to manage the archival of the certificate private key from the workstation to the KRA. I don't understand why it is involved with the OCSP.

Thank you for your time

Answer 1

Is it normal ? (I mean, the usual way to do).

sometimes it is. PKIView.msc relies on CA Exchange certificate information to retrieve CDP/AIA URLs for leaf CAs and then to build the hierarchy in the console. If you made changes, you have to revoke CA Exchange certificate, so next time you run pkiview.msc a new CA Exchange certificate will be generated with updated URLs.

Should I watch any side effect on the PKI when I delete and recreate this CA Exchange certificate ?

no. CA Exchange certificate is automatically controlled by CA. It is primarily used for key archival.

Answer 2

Thank you again for your answer :)