Home / server / Questions / 348242
Accepted
Brettski
Asked: 2012-01-10 12:58:05 +0800 CST

How long can a Microsoft Server CA be down before a cert will fail?

  • 772

We are using self-signed certificates for internal development machines and other internal connection encryption.

The certificates were created using Microsoft Certificate Server.

I need to move the certificate server from an old DC to a new DC, I am wondering how long the certificate server can be unavailable before the certificate cannot be verified and connections begin to fail.

I don't believe it is immediate, but I don't recall for sure.

windows-server-2008 windows-server-2003 certificate-authority

1 Answers

  1. Best Answer

    Certificates will begin to fail validation once the published Certificate Revocation List (or Delta CRL, if they're in use) expires or is inaccessible (make sure that not all of your distribution points are on the CA itself). This will depend completely on your configuration, and may be anywhere from under an hour to several months.

    The Enterprise PKI snap-in (pkiview.msc) is a good resource for checking the status and expiration times of your CRLs, and you can check their configured lifetimes on the CA.

    For the standard CRL:

    certutil -getreg ca\crlperiodunits
certutil -getreg ca\crlperiod

    And the delta:

    certutil -getreg ca\crldeltaperiodunits
certutil -getreg ca\crldeltaperiod
    • 7