Renewing CA certificate - PKI

Question

In 3 tier PKI hierarchy to renew IntCA cert

New CeRT/CrOSS CeRT

Will this create cross-sign certificates(0-1, 1-0) for SubCA, in addition to the new cert on IntermediateCA under CertSrv >> CertEnroll folder ?

• if yes then do this need to publish ""certutil -f -dspublish" the new Cert and cross-sign certificate.

New CRL

For new CRL, do this need to be published

Coping the new CRL to CDP will replace the old CRL ? as the existing certificate is still referring to the old CRL file ...

Answer 1

IntCA(1).CRT file need to be copied to AIA location (AD share location - configured for http/ldap)
IntCA(1).CRL file need to be copied to CDP location (AD share location - configured for http/ldap)

yes, they should be copied if not presented already.

what if I rename the existing"IntCA.CRL_old.crl" - will this work as new CRL is in the containor now ..?

you must not rename CRL. CA will automatically put proper name in CRL file name.

I don't understand why other 2 old CRLs keep updating

CA maintain CRLs for every its signing key pair even if they are expired.

Answer 2

Once IntCA certificate renewed - Until its been copied to AIA (http, LDAP) -- will IssCA still refer to the old IntCA certificate to build chain of trust.

• Intermediate new Certificate need to be pushed to 3rd party devices as well??

Answer 3

Thanks Crypt32 & DaisyZhou

There is one AD shared location for all CDP (LDAP/HTTP) - offline/online CAs.

When certificate will renew it then create new CRL(IntCA1.CRL) for new RSA Pair -- so

• Paste IntCA1.CRL to AD Location and rename/remove the existing "IntCA.CRL" -

or

• Paste IntCA1.CRL to AD Location only and keep IntCA.CRL as well as it is not expired yet and old certs still refer to this CRL -

or

• or leave it for now and replace the IntCA1.CRL with IntCA.CRL to AD location; when its about to expire.

Answer 4

Thanks guys - so just to confirm ... cross-sign certificates will not generate for InTCA .. right ??

Renew Certificate from RootCA - Once installed it on IntCA, it will create 2 new files (IntCA(1).CRT & IntCA(1).CRL) under CertSrv >> CertEnroll folder

IntCA(1).CRT file need to be copied to AIA location (AD share location - configured for http/ldap)
IntCA(1).CRL file need to be copied to CDP location (AD share location - configured for http/ldap)

On CDP location, there will be now 2 CRL files (IntCA.CRL & IntCA1.CRL) - how CA extentsion select or refer to the correct file as there are now 2 CRLs in CDP Container <CaName><CRLNameSuffix>.CRL -- what if I rename the existing"IntCA.CRL_old.crl" - will this work as new CRL is in the container now ..?

I found there are now 3 (IssCA, IssCA1, IssCA2) CRLs files and all of them update/publish every week ... Is this expected as 2 old CRLs keep updating .. in CERTENrol folder and CDP Shared folder ..?

(there is shared location for ldap/http - should copying the files there ..will work ??? as CRL coping to this shared location update CDP location

Answer 5

Will this create cross-sign certificates(0-1, 1-0) for SubCA

no, it won't. Cross-certificates are created only during Root CA renewal with new key pair. For intermediate CA certificates cross-certificates are not generated. You only need to copy new CA certificate to AIA location.

For new CRL, do this need to be published as well using "certutil -f -dspublish" or just coping to AIA/CDP publish location is required only.

CA will automatically publish new CRL when needed and copy it to CDP locations.

Coping the new CRL to AIA/CDP will replace the old CRL

It shouldn't. A new separate CRL is generated instead. Eventually, you get two separate CRLs for each CA signing key.

as the existing certificate is still referring to the old CRL file ... how this going to work

yes, that's how things work. Old certificates will refer to CRL signed using old CA key and new certificates will refer to new CRL signed using new CA key.