Question about Issuing CA Cert Renewal and manually requested Certs

Question

Hi,

I want to renew our Issuing CA's Certificate 5 year lifecycle one.

the question i have is if i renew the Issuing CA Certificate with the existing key,
will the existing issued certificates that where requested by admins using the CA Certsrv link get the new Date or will they expire on the date of what was on the old CA certificate before renewal?

basically just want to know what will happen to the old issued certs, since they where manually requested and not AD Enrolled.
so i can get the team to update them if needed when i renew the Issuing CA's Certificate.

I am hoping that they will see the New Issuing's cert and then will chain up to new CA cert without any changes required or needing to re-request new certificates for the systems.

Answer 1

Hi,
Based on my understanding, if the Issuing CA Cert was Renewal with the existing key, new CA cert ValidFrom (NotBefore) field will contain the value when existing CA key pair was generated. All previously issued certificates will chain up to new CA cert without any changes.
But validate period of the certs issued by CA before will not change.

We don't need to request a cert but need to renew them before expired.
You will need to renew them manually or configure them to renew automatically through GPO.
https://www.sysadmins.lv/blog-en/root-ca-certificate-renewal.aspx
This response contains a third-party link. We provide this link for easy reference. Microsoft cannot guarantee the validity of any information and content in this link.

Best Regards,

Answer 2

Hi,
If the Issuing CA Cert was Renewal with the existing key, new CA cert ValidFrom (NotBefore) field will contain the value when existing CA key pair was generated.
For example, my ca cert : valid from 5/15/2020 to 3/5/2031

After i renew the cert with the existing key ,the new CA cert Valid From 5/15/2020 to 6/23/2031

All previously issued certificates and new certs will chain up to new CA cert.
We just replace old CRT file in AIA download locations.

More detail about Renewal with existing key pair
https://social.technet.microsoft.com/wiki/contents/articles/2016.root-ca-certificate-renewal.aspx