Certificate expiration does not match validity period in template (Windows CA)

Question

I'm trying to request a new Bitlocker DRA certificate from my internal CA. The template is set to two years, as shown here Template

I'm trying to request a new certificate via the Certificates MMC via "Personal > Certificates > All Tasks > Request New Certificate". My two year Bitlocker DRA certificate appears with a 2 year validity period as depicted here. Enrollment

But when I approve the request the certificate is always only valid for 1 year Certificate

score 2 · Answer 1 · answered May 31 '19 at 15:23

2

This is because the CA that is issuing the certificate has it's signing certificate set to expire 6/29/2020. The certificate cannot be issued with an expiration date past the issuing CA's certificate.

answered May 31 '19 at 15:23

Joe

1,170
1
8
12

1

That's 100% correct, thank you! – user3708583 May 31 '19 at 15:25
No problem, glad I could help. – Joe May 31 '19 at 15:32

score 0 · Answer 2 · edited Dec 02 '21 at 12:02

0

If you run certutil -getreg CA\ValidityPeriod you will see "Years"

If you run certutil -getreg CA\ValidityPeriodUnits you will see the default value of 2

To increase this to ten years run certutil -setreg CA\ValidityPeriodUnits 10 and press ENTER.

Then run restart-service certsvc from an administrative Powershell console.

edited Dec 02 '21 at 12:02

shearn89

3,403
2
15
39

answered Nov 29 '21 at 08:05

Pay Man

1

Certificate expiration does not match validity period in template (Windows CA)

2 Answers2