Software

Ask something
Question Locked

Windows 2003 root CA hosed up

0 helpful
2 replies

by bernhardt

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

When I first set up this Win2K3 domain, I installed a root CA and a subordinate CA. We started to have problems with the certificate exchange within the domain, so I looked up the problem here and ran the certutil function, which cleaned it all up. the result is that all 3 DCs (including what was the root CA) now get their certificates from the subordinate CA. We have users that get certificates forwireless authentication, all of them already come from the subordinate CA.

That was OK, but now that we are expanding our use of CA services, we have a need for an authoritative root certificate. So, I see 3 options:
1. rebuild the whole CA system and issue all new certificates (not my preference).
2. Build a new root CA and somehow point the subordinate to the new root.
3. Promote the subordinate to root, and build a new subordinate.

I don't know the answer, that's why I'm here. Maybe there is another option? Can someone tell me how to fix this please?

thanks!

2 replies

by cg it

probably have already read through all this but it's a white paper on CA

http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/webenroll.mspx

This one is for SMB enterprise Root CA Authority

http://www.microsoft.com/technet/security/prodtech/windowsserver2003/build_ent_root_ca.mspx

note: see the section for creating custom CAs which is what your probably end up doing using your old CAs as custom CAs

This discussion is closed to new replies.