How to change the expiration date of certificates that are issued by a Windows Server 2003 or a Windows 2000 Server Certificate Authority (254632)


The information in this article applies to:

  • Microsoft Windows Server 2003, Enterprise Edition
  • Microsoft Windows Server 2003, Standard Edition
  • Microsoft Windows 2000 Server
  • Microsoft Windows 2000 Advanced Server
  • Microsoft Windows 2000 Datacenter Server
This article was previously published under Q254632
Important This article contains information about how to modify the registry. Make sure to back up the registry before you modify it. Make sure that you know how to restore the registry if a problem occurs. For more information about how to back up, restore, and modify the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows registry

IN THIS TASK

SUMMARY

This article describes how to change the validity period of a certificate that is issued by a Windows Server 2003 or a Windows 2000 Server Certificate Authority (CA).

By default, the lifetime of a certificate that is issued by a Stand-alone Certificate Authority CA is one year. After one year, the certificate expires and is not trusted for use. There may be situations when you have to override the default expiration date for certificates that are issued by an intermediate or an issuing CA.

The validity period that is defined in the registry affects all certificates that are issued by Stand-alone and Enterprise CAs. For Enterprise CAs, the default registry setting is two years. For Stand-alone CAs, the default registry setting is one year. For certificates that are issued by Stand-alone CAs, the validity period is determined by the registry entry that is described later in this article. This value applies to all certificates that are issued by the CA.

For certificates that are issued by Enterprise CAs, the validity period is defined in the template that is used to create the certificate. Windows 2000 and Windows Server 2003 Standard Edition do not support modification of these templates. Windows Server 2003 Enterprise Edition supports Version 2 certificate templates that can be modified. The validity period defined in the template applies to all certificates issued by any Enterprise CA in the Active Directory forest. One exception is the Subordinate CA certificate templates. There is no validity period defined in this template. Instead, the CA's registry validity period determines the validity period of the Subordinate CA certificate. A certificate that is issued by a CA is valid for the minimum of the following periods of time:
  • he registry validity period that is noted earlier in this article.

    This applies to the Standalone CA, and Subordinate CA certificates issued by the Enterprise CA.
  • The template validity period.
This applies to the Enterprise CA. Templates supported by Windows 2000 and Windows Server 2003 Standard Edition cannot be modified. Templates supported by Windows Server Enterprise Edition (Version 2 templates) do support modification.

The expiration date of the CA certificate

A CA cannot issue a certificate with a longer validity period than its own CA certificate. For more information about certificate templates, see the "Implementing and Administering Certificate Templates in Windows Server 2003" white paper. To do this, visit the following Web site:

http://technet2.microsoft.com/WindowsServer/en/library/c25f57b0-5459-4c17-bb3f-2f657bd23f781033.mspx?mfr=true

Note The Request Attribute name is made up of value string pairs that accompany the request and that specify the validity period. By default, this is enabled by a registry setting on a Standalone CA only.

back to the top

To Change the Expiration Date of Certificates That Are Issued by a Windows Server 2003 or a Windows 2000 Server Certificate Authority

To change the validity period settings for a CA, follow these steps.

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall your operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.
  1. Click Start, and then click Run.
  2. In the Open box, type regedit, and then click OK.
  3. Locate, and then click the following registry key:

    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\CertSvc\Configuration\<CAName>

  4. In the right pane, double-click ValidityPeriod.
  5. In the Value data box, type one of the following, and then click OK:
    • Days
    • Weeks
    • Months
    • Years
    .
  6. In the right pane, double-click ValidityPeriodUnits.
  7. In the Value data box, type the numeric value that you want, and then click OK. For example, type 2.
  8. Stop, and then restart the Certificate Services service. To do so:
    1. Click Start, and then click Run.
    2. In the Open box, type cmd, and then click OK.
    3. At the command prompt, type the following lines. Press ENTER after each line.

      net stop certsvc
      net start certsvc

    4. Type exit to quit Command Prompt.
back to the top

REFERENCES

For more information about Certificate Services in Windows Server 2003, see the Public Key Infrastructure topic in the "Security" section of the Windows Server 2003 product documentation. To view the Windows Server 2003 product documentation, visit the following Microsoft Web site:

http://www.microsoft.com/windowsserver2003/proddoc/default.mspx

back to the top
Modification Type:MajorLast Reviewed:9/21/2006
Keywords:kbenv kbHOWTOmaster KB254632 kbAudITPro
©2004 Microsoft Corporation. All rights reserved.