Question on Domain CA issued Certificate

Question

Question on Domain CA issued Certificate

TonyJK 881

In a Testing Windows 2016 Server, we find that there is a Domain CA issued certificate. However, from our memory, no IT staff requests for such SSL Certificate.

Just wonder whether the Domain CA can issue certificate automatically ?

Besides, the Certificate is going to expire, what is the best way to renew that Domain CA issued Certificate ?

Thanks

Accepted answer

0 additional answers

Your answer

Answer 1

Yurong Dai-MSFT 2,846 Microsoft External Staff

Hi @TonyJK ,

Typically, the root certificate for your internal PKI is distributed via GPO to all clients. This allows domain CA to issue certificate automatically .

If you install the root CA's certificate, all subordinate certificates are trusted - including certificates issued directly by your root CA, as well as any issued by any subordinate CAs. (If you have a really big PKI environment, that becomes important.)

If your root CA is a domain-joined server, the root CA certificate is automatically published to DCs and clients. The client sends a renewal request to the CA, so you automatically get a new CA certificate.

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the email notification for this thread.

Best regards,
Yurong Dai

TonyJK 881 Reputation points

2022-07-11T06:00:38.017+00:00

Dear Yurong,

Thanks for your advice.

Can I confirm if we enable Server Certificate Auto-Enrollment as mentioned in the following URL, CA will issue Certificate to Server when it joined Domain & renew automatically when it expires ?

https://learn.microsoft.com/en-us/windows-server/networking/core-network-guide/cncg/server-certs/configure-server-certificate-autoenrollment#configure-server-certificate-auto-enrollment

Thanks again
TonyJK 881 Reputation points

2022-07-11T06:49:05.663+00:00

Hi,

Can I ask is it possible to change how long the newly issued certificate last (Like: Valid for 3 years) ?

Thanks
Yurong Dai-MSFT 2,846 Reputation points Microsoft External Staff

2022-07-11T08:08:06.057+00:00

Hi @TonyJK ,

On how to change the expiry date of a certificate issued by a certificate authority, you can get more from here.
Yurong Dai-MSFT 2,846 Reputation points Microsoft External Staff

2022-07-11T08:56:42.337+00:00

Hi @TonyJK ,
You may be able to check through the Group Policy Editor to see if the Certificate Services Client-Auto-Enrollment property is enabled and tick Renew expired certificates in the public key policy...

Share via

Question on Domain CA issued Certificate

0 additional answers

Your answer