Cannot generate certificate when Certificate template valid period longer than the CA

Question

Hi Support,

We have a root CA and intermedia CA
In root CA, root certificate valid period is 20 years, generate certificate valid period is 1 year
In intermedia CA, generate certificate valid period is 2 years

I created a certificate template and configure the valid period is 5 years. When i generate certificate by this templates, it show error:
Unable to submit the CSR request to certificate authority.-Error Constructing or Publishing Certificate
The certificate validity period will be shorter than the xxxxx Certificate Template specifies, because the template validity period is longer than the maximum certificate validity period allowed by the CA.
Consider renewing the CA certificate, reducing the template validity period, or increasing the registry validity period.

Then I try to modify the value to 10 years by command and registry. But the problem still exist

Any idea?

Thank and Best Regards
Chong

Answer 1

Hello @Chong ,

By default, the lifetime of a certificate that is issued by a Stand-alone Certificate Authority CA is one year. After one year, the certificate expires and is not trusted for use.

There may be situations when you have to override the default expiration date for certificates that are issued by an intermediate or an issuing CA.

Various applications that use certificates and Public Key Infrastructure (PKI) might experience intermittent problems, such as connectivity errors, once or twice per day/week.

These problems occur because of failed verification of the end-entity certificates. Affected applications might return different connectivity errors, but they will all have untrusted root certificate errors in common. Below is an example of such an error and resolving techniques are mentioned in the below link:

https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/valid-root-ca-certificates-untrusted

For further details on how to change the validity period of a certificate that is issued by the Certificate Authority (CA). do follow the below link

https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/change-certificates-expiration-date

Hope this answers all your queries, if not please do repost back.
If an Answer is helpful, please click "Accept Answer" and upvote it : )

Answer 2

The reason is that the resulting certificate´s validity would be beyond the CA´s certificate.
And this is a constraint

Issued Cert valid until must be always less than the issuing CA Certificate.

krgds,

Alexander