If an EFS certificate is expiring and attempting to renew itself AND the issuing subordinate which issued that certificate is down, offline, or has it's subordinate certificate expired, will the EFS certificate renew from a different issuing subordinate server that has the same published template?

If so, is it possible for the user to decrypt his/her old files with the new certificate?

2 Answers 2


Unfortunately I don't know the answer to the first half of your question. I believe the answer is that the client will enroll with a different CA for a new EFS cert, but I'm not certain if it will use the same key pair for that renewal or generate a new key pair.

Regardless of specifics, the client won't discard the old EFS certificate and key when it receives a new one. They will stay in the local key store and still be accessible when the user attempts to access any previously encrypted files. I believe any time an encrypted file is accessed that EFS will update the associated file encryption key (FEK) entry with the new cert and/or private key. This is something you could test by setting up this scenario and seeing what cert thumbprints are associated with the file before and after.


These are the test results.

If an EFS certificate has expired and the CA server that issued this certificate is offline, the local computer will generate a new one. This can be a self signed certificate (SHA1) or a certificate from another CA server.

As long as you have the (expired) certificate with the private key, the files can be unlocked/decrypted.

Files that already exist, will use the old certificate, even if you edit the files. New files will be encrypted with the new certificate.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .