Home / server / Questions / 892639
Accepted
Tobias
Asked: 2018-01-18 02:57:12 +0800 CST

Windows CA Certificate Template Supersedence

  • 772

I have an internal Microsoft Windows CA (Windows Server 2012R2). I have a CodeSigning Template issued to a small number of users, valid for 6 years. Now i wanted to supersede the 6-year template with another one with a shorter validity.

I duplicated the template, changed the value of "Validity period" from 6 to 3 years, and added the 6-year template unter "Superseded Templates". Then i disabled the 6-year template and enabled the 3-year template.

When i now go to a client and try "Renew the certificate with the same key", this does not work since the 6-year template is missing.

So my questsions:

  • Is it at all possible to renew a certificate with the same key when the template used for this certificate is superseded?
  • Do i need to keep the superseded template enabled?

Thanks for any input

windows-server-2012-r2

1 Answers

  1. Best Answer

    Certificate Template supersedance is used by certificate autoenrollment component only. No other (I'm aware of) tools takes this setting into consideration.

    When you do manual enrollment and/or existing certificate renewal, supersedence is not considered and requires exact template to request/renew.

    • 2