3 ms·
When you set up the intermediate CAs, I installed the root public key, but the intermediate CAs wanted to know "where" the CA running with the root private key
by UnoriginalGuy 11y ago
When you set up the intermediate CAs, I installed the root public key, but the intermediate CAs wanted to know "where" the CA running with the root private key was, I didn't have an online root (I generated then took it down), and the intermediate CA wasn't having any of that.
- geofft 11y agoIf nothing else, you should be able to tell the intermediate CA to pretend that a root and then re-sign its public key with your actual root, and then hand the actual root to clients, and hand the new intermediate CA cert to servers to use in the chain. I'm pretty sure the signing process only depends on the public key, not on the entire cert. This is how cross-signatures work: new CAs will get their intermediate keys cross-signed by existing CAs, so that you can construct a valid chain from them. This creates a different CA certificate, but it's using the same public key, so the end-entity certs validate with either CA certificate.
- thomnottom 11y agoI did this a couple years ago and assisted another admin with an install last year. Here is one of the guides I used to get me through it: https://itworldjd.wordpress.com/2013/03/20/ad-cs-2008-r2-install-guide/ https://itworldjd.wordpress.com/2013/03/20/ad-cs-2008-r2-ins...