1

I have a Code Signing cert signed by an internal Windows CA. The person who monitored our certs left our company and this cert recently expired. I am hitting the CA website and I'm in the renew area, however I am unable to figure out how to locate a PKCS#7 renewal request for the cert.

The Cert in question is a Trusted Publisher for our domain workstations.

I can export the cert to a *.p7b file, which shows as a PKCS #7 Cert, however I still can't get it into the website for the renew request.

Do I have any options other than revoke and generate a new one? I'd like to avoid that if possible, as I'll have to go around and resign something on the order of 80 PowerShell scripts and programs that I've signed in the past couple years.

Google has been less than helpful, although it's shared lots of results about purchased certs, or ClickOnce certs, or expired WebCerts. Not much for MS CA expired Code Signing ones, though. :(

Any thanks would be appreciated!

Improve this question
1
  • Went ahead and just issued a new cert. Apparently for self-signed MS certs there is a 28 hour limit post-expiry to renew them. Oh well.
    – Ryan Aubrey
    Commented Aug 4, 2016 at 16:15

1 Answer 1

Reset to default
1

Few things to know:

  1. you cannot renew expired certificate. This is because existing certificate is used to sign renewal request. Since the certificate is expired, it cannot be used to sign request. Even if you try it, CA will reject renewal request because it was signed by an expired certificate.

  2. instead of renewal, you should go to the same process you went for initial code-signing certificate enrollment. Just enroll a new one and use it to sign the data.

  3. I discourage ADCS Web Enrollment usage, because it offers very and very limited functionality and requires ActiveX. Especially, for Enterprise CAs. Instead, you should consider to use Certificates MMC snap-in which provides powerful tool for certificate enrollment.

Improve this answer
2
  • We were hoping to renew instead of create a new one, just so we didn't have to revoke the previous and then resign all of the certs on the scripts. We did go ahead and issue a new cert anyways. I'll definitely pass along the recommendation to change our process to the snap-in instead of web-based method. Thanks!
    – Ryan Aubrey
    Commented Aug 5, 2016 at 14:41
  • You don't have to revoke old certificate. Just enroll a new one.
    – Crypt32
    Commented Aug 5, 2016 at 14:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .