Is it possible to set the expiration date of a certificate

ad-certificate-services

I am trying to test certificate validation logic in an installer.

I have a test domain with Active Directory Certificate Services installed. Both the domain controller and CertServ are base installations with minimal configuration.

Is there a way to control the expiration date of a certificate when requesting a certificate?

Ideally I would like issue a certificates that expire today, tomorrow and yesterday(already expired)

Best Answer

In ADCS You can change the validity period in the certificate templates. I suggest you duplicate a template and then go to the properties / general tab and you will see an option for validity period.

This only affects certificates that are issued after the change. Validity periods of previously issued certs will not change

Related Solutions

How to publish a CRL for an internal Windows certification authority

You will need to modify your CA's CRL locations via the Certification Authority snap-in. Right-click on the CA, select 'Properties', then the Extensions tab. Select the 'CRL Distribution Point' extension and add the needed locations.

Full instructions are located on Technet: http://technet.microsoft.com/en-us/library/ee649168(WS.10).aspx

Unfortunately, the CRL paths are 'wired' to the issued certs, so if you already have certs that have been previously issued, they will need to be reissued. Just create a new certificate template that supersedes the old one and configure your machines to autoenroll.

Microsoft Standalone CA – Set expiration date of an individual request

According to Windows 2000 documentation:

All certificates that the stand-alone CA issues have the lifetime specified by the
values of the ValidityPeriod and ValidityPeriodUnits registry entries. Therefore, if
you want to issue certificates with different lifetimes, you must deploy either
enterprise CAs, multiple stand-alone CAs, or third-party CAs.

This still seems to be valid, according to a recent post on social.technet.microsoft.com.

I ended up changing the registry value, issuing the certificate, and then changing it back.

Best Answer

Related Solutions

How to publish a CRL for an internal Windows certification authority

Microsoft Standalone CA – Set expiration date of an individual request

Related Topic