Newbie cert renewal question.

Question

My Sr sys admin has been on leave for months so cert renewals have fallen to me.

I need to update our root cert, then renew certs on our 2 rds servers, the distribute and package the rdp apps that run on the server and deploy these packages and certs to users via intune.

I have never done any of this before, What should I watch out for? Is there anything obvious I am not considering?

I am not even sure what to ask, as I don't know what I don't know.

Answer 1

Key areas to watch out for are root CA renewal impact, client trust distribution, and timing/rollback planning. The context only covers parts of this, so the answer focuses on those supported aspects.

1. Root CA renewal and client trust

• When renewing a root CA, all clients must trust the new root certificate before it is used in production.
• For a standalone CA, export the renewed root certificate and distribute it to all trusted clients, typically via Group Policy for domain-joined machines. Non-domain-joined devices may require manual distribution.
• After renewal, verify that the new root CA certificate is trusted by all clients and monitor for any certificate trust or authentication issues.

2. Post‑renewal monitoring

• After renewing the root CA and any dependent certificates (such as those used by RDS or web services), monitor the environment for:
  • Authentication failures
  • TLS/SSL trust warnings on clients
  • Application connection issues
• Be prepared to troubleshoot quickly if clients do not trust the new root or if some systems still rely on the old one.

3. Timing and cutover

• Avoid a “knife‑edge” cutover where everything changes at once at the moment of expiration. Ensure the new root and any new service certificates are deployed and trusted well before the old ones expire.
• Plan a window where both old and new trust chains are available so that clients can transition without downtime.

4. Auto‑enrollment and renewal

• If using an Enterprise CA, consider configuring certificate auto‑enrollment and renewal for servers and clients. This can simplify future renewals and ensure trusted root distribution to all domain‑joined systems.
• Note that auto‑enrollment does not automatically reconfigure all applications to use the new certificate; some apps (like Operations Manager in the context) still require an explicit re‑import or configuration update after renewal.

5. Manual vs automatic renewal behavior

• Some Windows components and MDM/Intune scenarios support automatic certificate renewal, but automatic renewal typically stops working once a certificate is already expired. Renewal periods and retry intervals must be configured so renewal happens well before expiration.
• Plan renewal periods a significant time (for example, 40–60 days) before expiration and use retry intervals of a few days to increase the chance that devices renew in time.

6. General risk points to consider

• Ensure that any renewed service certificates chain to the renewed root CA that clients already trust.
• Confirm that any applications or services that pin certificates or thumbprints (for example, by storing a specific certificate thumbprint in configuration) are updated after renewal if a new certificate or key is used.
• For non‑domain‑joined or remote devices, validate that they receive the new root and any intermediate certificates before switching services to use them.

In summary, the main things to watch out for are: distributing and trusting the renewed root CA on all clients, renewing dependent service certificates in time, avoiding last‑minute cutovers, and monitoring closely after changes.

---

References:

• Renew root CA certificate
• Certificate Renewal
• Obtain a certificate for use with Windows Servers and System Center Operations Manager
• Certificate life cycle and renewal