4

I have setup my MS-ADCS environment in my company and configured auto-enrollment. i have everything working great, but found out that I want my "Subject Name Format" to have a different value. We are not using the certificates yet in any service, so there's no real problem removing them and reissue new ones. My question is - what the the best way or the right way to remove all issued certificates (~200) with the wrong subject value and deploy the new certificates with the new (and right) subject value? All users are in AD and I can use scripts or group policy if needed.

Thanks.

EDIT: just to clarify my intent - I prefer to remove/delete the issued certificates with the wrong subject format and don't care at this point about revocation list (note - I am aware to the consequence).

Improve this question

3 Answers 3

Reset to default
4

ADCS has a feature for this.

Assuming you have the Certificate Services Client - Auto-Enrollment group policy configured, simply create a new template in the MMC with the correct SAN configuration and add the original template name to the Superseded Templates tab. Group policy will enroll for a new certificate with this template and delete the original for you.

There's no need to revoke anything as nothing's been compromised.

Improve this answer
1
  • Nice! That makes perfect sense... +1 for the answer, I'll update about the results.
    – DaveIce
    Dec 17, 2018 at 10:52
1

If you don't use the certificates at any service and they don't have a real purpose atm, I guess it would be the best to revoke the issuing intermediate CA and create a new one issuing the right certificates.
This would be the most maintainable way to revoke all the certificates and your CRL would not get bloated before you even start using the certificates.

Improve this answer
1
  • that is correct, but I prefer to remove the certificates with the wrong subject and have my users with the corrected certificate.
    – DaveIce
    Dec 17, 2018 at 9:16
1

I think I've found the answer: right clicking the template with the new change, there is an option to "Reenroll All Certificate Holders". Once choosing that, the template version increases, so the next time the client verifies the certificate version against the template version on the CA - the client will re-enrolls. I tested it with a restart of one of the laptops and the result was only 1 user certificate with the right Subject format. note: i think for this option to show up, Auto-enrollment must be configured for the template.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .