how to migrate PKI RSA key size from 2048 to 4096 in windows server 2016

Question

Can anyone help with how to migrate PKI RSA key size from 2048 to 4096 in windows server 2016. Below are some more details regarding infra. how to fulfill it? 

 

 In the infra there is one offline Root CA and two subordinate online CA which are on RSA 2048 key current key is used 2048 on Root and Subordinate CAs. 

Answer 1

Hello Ramkumar,

Thank you for posting question on Microsoft Windows forum!

You can upgrade the root CA key from 2048 bits to 4096 bits by modifying the CAPolicy.inf file and updating the RenewalKeyLength parameter, without needing to completely rebuild the CA. However, there are some critical steps and limitations to be aware of.

1、 Modify the CAPolicy.inf File

On the offline root CA, edit %SystemRoot%\CAPolicy.inf (create the file if it doesn’t exist):

[Version]
Signature="$Windows NT$"
[Certsrv_Server]
RenewalKeyLength=4096       ; New key length
RenewalValidityPeriod=Years ; Optional: defines the renewal validity period unit
RenewalValidityPeriodUnits=10 ; Optional: sets the new CA certificate validity (e.g., 10 years)

You can learn these settings more at Microsoft site.

2、Then you can start the root certificate renewal process as shown in the image. Please note that the CA will use the newly created root certificate. So, if your internal CA is standalone or offline CA, you would need to publish the newly created root certificate to the client root certificate store by running certutil command.

certutil -f -dspublish <the path of CA certificate> RootCA

If your CA is an enterprise CA, then it will publish the root certificate automatically and you need to do nothing.

Hope the above information is helpful to you.