Does root CA expire?
Certificate authorities (CAs) adhere to strict requirements to merit the trust of having a root certificate. Root certificates also typically have long periods of validity, compared to intermediate certificates. They will often last for 10 or 20 years, which gives enough time to prepare for when they expire.
Does a root CA have a CRL?
The root CA server is, however, configured to use a CRL distribution point. This CDP may be stamped on those certificates that the CA signs. The Root CA then signs its Certificate Revocation list, and the signed CRL should be placed in that configured location.
Can a CA expire?
Summary. By default, the lifetime of a certificate that is issued by a Stand-alone Certificate Authority CA is one year. After one year, the certificate expires and is not trusted for use. The validity period that is defined in the registry affects all certificates that are issued by Stand-alone and Enterprise CAs.
Why is Root CA kept offline?
A common method to ensure the security and integrity of a root CA is to keep it in an offline state. It is only brought online when needed for specific, infrequent tasks, typically limited to the issuance or re-issuance of certificates authorizing intermediate CAs.
Is the offline root CA an outdated concept?
Offline root CA is an outdated concept. My first experience with PKI was back in 1997. We (Andy Khomenko, currently with Caspio, and I) have been developing a business-to-business e-commerce site. We decided to use client certificates for authentication, as just-released IIS 2.0 on Windows NT 4.0 was supporting them.
How to build an offline root certification authority ( CA )?
In Windows Explorer, locate the certificate and certification path files you just copied, then right-click each file and choose Install Certificate. Have the Certificate Import Wizard automatically place the certificates in stores based on the type of certificate. There are several considerations related to building an offline root CA.
Can a subordinate CA be revoked by an offline root CA?
Should a subordinate CA become compromised, not all is lost since the offline root CA is fine. However the far majority don’t include a CRL Distribution Point (CDP) making it impossible to determine what certificates have been revoked. Thus making revocation of an immediate subordinate CA similar to that of a root CA revocation.
What happens if you Lose Your offline root certificate?
There are two common fault scenarios: issuance of certificates to unintended recipients; and losing ownership of the CA keys. The first scenario is not mitigated by the offline root: you revoke the certificates and possibly review the process. That’s happened with Verisign and other commercial CAs.