Re-sign a certificate with certutil
Sometimes it is useful to be able to simply re-sign a certificate, without following a complete certificate signing request process.
It is better from a secuity point of view to rotate the keys often, but in certain scenarios the ability to modify the lifetime of certificate might come in handy.
In those cases certutil can be used to modify the validity of a certificate at will, with its -sign verb.
https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil#-sign
The most straightforward example is a certificate you want to be valid for a few days:
certutil -sign <OriginalCertificateFile> <NewCertificateFile> now+7:00
where
<OriginalCertificateFile> is the file containing the certificate you want to re-sign
<NewCertificateFile> is the file where the re-signed certificate will be stored
now indicates the "Not Before" for the new certificate, setting it to current time
7:00 indicates the validity of the new certificate, in days:hours format
The command above will result in a new certificate file with the samevalues as the old one but valid for a week from the time of signing.
In a typical AD CS setup the command can be run from the Certification Authority server itself using an Administrator command prompt.
Even if there is only one CA available and even if it is local, the command above will trigger a Certification Authority selection pop-up, where the appropriate CA must be chosen.
It is better from a secuity point of view to rotate the keys often, but in certain scenarios the ability to modify the lifetime of certificate might come in handy.
In those cases certutil can be used to modify the validity of a certificate at will, with its -sign verb.
https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil#-sign
The most straightforward example is a certificate you want to be valid for a few days:
certutil -sign <OriginalCertificateFile> <NewCertificateFile> now+7:00
where
<OriginalCertificateFile> is the file containing the certificate you want to re-sign
<NewCertificateFile> is the file where the re-signed certificate will be stored
now indicates the "Not Before" for the new certificate, setting it to current time
7:00 indicates the validity of the new certificate, in days:hours format
The command above will result in a new certificate file with the samevalues as the old one but valid for a week from the time of signing.
In a typical AD CS setup the command can be run from the Certification Authority server itself using an Administrator command prompt.
Even if there is only one CA available and even if it is local, the command above will trigger a Certification Authority selection pop-up, where the appropriate CA must be chosen.
Comments
Post a Comment