Microsoft allows a CA to use Cryptography Next Generation (CNG) and [advises of incompatibility issues][1] for clients that do not support this suite. Here is an image of the default cryptography settings for a 2008 CA. This machine is a non-domain connected Standalone CA: ![Default Cryptography settings][2] My intent is to have a general-purpose offline Root-CA and then several Intermediate CAs that serve a specific purpose (MSFT-only vs Unix vs SmartCards etc) What are the ideal settings for a Root Certificate with an expiration of 5, 10, and 15 years? 1. CSP 2. Signing Certificate 3. Key Character Length [1]: http://technet.microsoft.com/en-us/library/cc730763%28v=ws.10%29.aspx [2]: https://i.sstatic.net/zfU7l.png