In this demonstration, we're going to renew the CA certificate.
You usually do this about one year before it expires.
That way, you're assured there's no disruption to your certification authority.
We need to know what key type to use because sometimes
within the 10 years that it expires, that key type might change.
We are on CA1 and we're going to start a Microsoft Management Console.
And I want to show you something else.
Once you start the console and get it just where you want it,
we're going to say File, Add/Remove Snap‑in, and add the Certification Authority,
click on Add.
It's a Local computer and click on OK.
You can come down here and actually save this and save it to wherever you want.
In this case, we'll say CA and then click on Save.
So you don't have to keep coming in here,
Add/Remove Snap‑in, etc if you're going to work on it a lot.
Let me maximize this.
I want to state this, if you are doing this remotely,
because we can come here and say Retarget Certification Authority,
you cannot renew the root certificate remotely with this interface.
You have to be inside of the machine itself.
So let's go ahead and expand this.
And we have CarvedRockRootCA right here.
We're going to right‑click All Tasks and come down here to Renew CA Certificate,
and we get a warning.
It says well you have to stop the CA service in order to perform this operation,
and we're just fine with that.
We're going to click on Yes.
Now why would you need to renew a certificate?
Keep in mind,
the root CA is the backbone of your certification authority hierarchy.
If the certificate is about to expire, you need to renew that,
probably a year in advance, because if your certificate is expired,
you're going to run into trouble here.
Now your first question is this,
do you want to generate a new public and private key or keep the ones
that you had? If the signing key is compromised,
you want a new key. If somebody stole it or you're coming in here to
renew it because it's not safe anymore, you want a new key. We don't,
so we're going to come down here and say No.
Another reason you might want to do this is changing technology.
There is a new cryptographic algorithm or standard that you want to use for
some of the new technology that might have come up in the five years that you
originally built that public and private key.
That's not the situation for us, so we're going to say No.
And then click on OK. It takes just a second to go through there, renew the
certificate, and we're good for another five years or so.
We can set this thing aside, somewhat forget about it and then
hopefully put it on our schedule to go in there and renew this
certificate for whoever might be out there in the future.
I'm going to come up here.
We're going to right‑click on this say All Tasks, and you
can see the service has started again.
The behavior for old Certificate Services, you had to go in there
and manually restart it, but we're good here.
So that certificate is renewed for our root CA, and
we're good for another five years.
This operation is crucial to the security of your system.
Now let's go to CA2, and I'll show you how to renew that certificate
from the root. Inside of CA2, we're going to go through the same
process that we did before. This should start looking familiar to
you because we have done this before when we certified the
subordinate CA to the root CA.
I'm going to just say Add/Remove Snap‑in.
Come here to Certification Authority,
click Add, it's Local, and then click on OK. Now we can expand this.
Come down here to CarvedRockIssueCA, go to All Tasks, and Submit new request.
We can see our old request right here, and this process is just the same.
I'm not going to go through this, but I'll describe it. The
process is just the same as we saw before.
We would take this request file to CA1, submit it,
get a new certificate, transfer it CA2, and then install it there.
So we'll go ahead and click on Cancel.
So that is how you renew the certificates for your certificate
servers, both a standalone root CA and also a subordinate
enterprise CA in Windows Server 2022. Up next, we're going to back up our root CA.