How to update the validity period of an existing CA template programatically or using command-line program

Question

I'm looking for a way to update the Validity period of an existing CA Template, do you know if this is possible using certutil, any other command or programatically with Powershell or C#.

The CA is running on Windows Server 2008 R2.

My goal is run a script on a daily basis to update the validity period for a specific template in order that any request enrolled using that template expires on a specific date, let's say Dec 31st, 2016.

Thanks,

Answer 1

Assuming you are running an AD CS Enterprise CA, certificate templates are stored in Active Directory, located in the Configuration NC.

(As noted by CryptoGuy in the comments, this approach is not supported by Microsoft - you really should just be using the Certificate Templates mmc, certtmpl.msc, for this task)

To retrieve a certificate template:

$CertTemplateParams = @{
    LDAPFilter = '(&(objectClass=pKICertificateTemplate))'
    SearchBase = 'CN=Certificate Templates,CN=Public Key Services,CN=Services,{0}' -f ([adsi]'LDAP://RootDSE').configurationNamingContext[0]
    Properties = 'pKIExpirationPeriod'
}
$Templates = Get-ADObject @CertTemplateParams

Filter the template you need:

$UserTemplate = $Templates |Where-Object { $_.Name -eq "User" }

The pKIExpirationPeriod attribute represents a 64-bit FILETIME struct, but you can convert it to a timespan with [BitConverter]::ToInt64():

# File time type counts in 100-nanosecond intervals, we need seconds
$Validity = New-TimeSpan -Seconds $([System.BitConverter]::ToInt64($UserTemplate.pKIExpirationPeriod, 0) * -.0000001)

Now add some time to the timespan:

$Validity.Add($(New-TimeSpan -Days 365))

Convert it back to a 64-bit byte array:

$NewExpirationPeriod = [System.BitConverter]::GetBytes($($Validity.TotalSeconds * -10000000))

Use Set-ADObject to change the template object:

Set-ADObject -Identity $UserTemplate.objectGuid -Replace @{pKIExpirationPeriod = $NewExpirationPeriod}

Answer 2

http://www.expta.com/2010/08/how-to-create-certificates-with-longer.html

According to this, you can change the CA Lifetime or the Maximum validity period using certutil. I assume that your template expiration is limiting you. Perhaps create a new template with a longer expiration date?

Answer 3

To calculate the

$NewExpirationPeriod = [System.BitConverter]::GetBytes($([Int64]$Validity.TotalSeconds * -10000000))