Primary keyword: domain CA renewal deployment Secondary keywords: certificate authority renewal, on-prem CA server, enterprise PKI deployment, CA certificate renewal SEO support keyword: Windows Server CA renewal, active directory certificate services Content type: Deep-dive tutorial Estimated reading time: 28 minutes Last verified: March 2026
Figure: Certificate authority hierarchy and the renewal / revocation lifecycle.
Figure 1: Two-tier PKI architecture showing offline root CA and online enterprise issuing CA with certificate lifecycle management.
[!TIP] Presentation note for publishing: This diagram illustrates the recommended enterprise PKI design that balances security (offline root) with operational efficiency (online issuing CA).
Executive Snapshot
Category
Recommendation
CA renewal planning horizon
Begin 12 months before expiration
Critical first step
Document current PKI topology and certificate inventory
Renewal strategy
New key generation (preferred) vs. same key reuse
Validation approach
Test CA chain in lab environment before production
Governance cadence
Quarterly PKI health checks, annual renewal assessment
Backup requirement
Full CA backup + registry + database before any renewal
TL;DR
If you only have 10 minutes:
Plan ahead: Start CA renewal planning 12 months before certificate expiration to avoid emergency scenarios.
Backup everything: Full system state backup, CA database, registry, and private keys before any changes.
Two-tier is standard: Offline root CA (10-20 year validity) + online enterprise issuing CA (5-10 year validity).
Generate new keys: During renewal, generate new key pairs rather than reusing existing keys for enhanced security.
Test certificate chain: Validate the renewed CA chain in a test environment before production deployment.
Publish CRL/OCSP: Ensure CRL Distribution Points and OCSP responders are accessible throughout the renewal.
Monitor certificate health: Use PKI monitoring tools to track certificate expiration across your environment.
Active Directory Certificate Services (AD CS) is the foundation of enterprise PKI infrastructure. A poorly executed CA renewal can break authentication, encryption, VPN access, and critical business applications. This guide provides a battle-tested approach to CA renewal and deployment that minimizes risk and downtime.
Who This Guide Is For
This guide is for:
Windows Server administrators managing enterprise certificate authorities
Security engineers responsible for PKI infrastructure and certificate lifecycle management
Infrastructure architects designing or maintaining on-premises CA hierarchies
Compliance teams ensuring PKI meets regulatory and audit requirements
You will learn how to plan and execute a complete CA renewal cycle, deploy new enterprise CA servers, and establish operational best practices for certificate lifecycle management.
Prerequisites
Knowledge Requirements
Intermediate understanding of Windows Server administration
Familiarity with Active Directory Domain Services (AD DS)
Basic understanding of Public Key Infrastructure (PKI) concepts
Experience with PowerShell scripting (helpful but not required)
Licensing and Roles
Windows Server 2019/2022 Standard or Datacenter licenses
Enterprise Administrator or Domain Administrator role for AD CS installation
Local Administrator rights on CA servers
Security Administrator role for certificate template management
Environment Requirements
Active Directory domain (functional level 2016 or higher recommended)
Two dedicated servers for two-tier PKI (one can be virtual for issuing CA)
Internet-accessible web server for CRL/AIA distribution points (optional but recommended)
Network connectivity between CA servers and domain controllers
DNS properly configured with forward and reverse lookup zones
Tools Required
Windows Server with Desktop Experience (for CA management console)
PowerShell 7.2+ with PKI module installed
Backup solution capable of full system state backup
\ ┌─────────────────────────────────────┐
│ Offline Root CA │
│ – 10-20 year validity │
│ – Generates issuing CA certs │
│ – Powered off when not in use │
│ – Physically secured │
└─────────────┬───────────────────────┘
│
│ Issues subordinate cert
↓
┌─────────────────────────────────────┐
│ Enterprise Issuing CA │
│ – 5-10 year validity │
│ – Online 24/7 for cert issuance │
│ – Integrated with Active Directory │
│ – Publishes CRL/OCSP │
│ – Issues certificates to endpoints │
└─────────────────────────────────────┘
\\
Advantages:
Simpler to manage and troubleshoot
Adequate security for most organizations
Lower infrastructure costs
Faster certificate chain validation
Three-Tier PKI (For Large Enterprises or High-Security Environments)
\ Root CA (offline)
└── Policy CA (offline/semi-online)
└── Issuing CA (online)
\\
When to use three-tier:
Multiple geographic locations requiring regional issuing CAs
Different certificate policies for separate business units
Merger/acquisition scenarios with separate PKI hierarchies
Regulatory requirements for additional security layers
Certificate Validity Periods: Industry Best Practices
CA Type
Recommended Validity
Rationale
Root CA
15-20 years
Rarely changed, maximum stability
Issuing CA
5-10 years
Balance between security and operational overhead
Server certificates
1-2 years
Industry standard (Apple/Google enforce 398 days in 2026)
User certificates
1 year
Aligns with annual user recertification
Device certificates
2-3 years
Reduces endpoint certificate churn
Important: Modern browsers and operating systems increasingly distrust certificates with validity periods exceeding 398 days (13 months). Plan server certificate lifetimes accordingly, even if your internal CA can issue longer-validity certificates.
CA Certificate Renewal Strategies
Strategy 1: Renew with New Key (Recommended)
Process:
Generate new public/private key pair
Create new CA certificate with new key
Publish both old and new CA certificates during transition
Advantages:
✅ Enhanced security (new cryptographic material)
✅ Aligns with cryptographic best practices
✅ Provides clear migration path
Disadvantages:
⚠️ All issued certificates must be reissued
⚠️ Requires planning and testing
⚠️ Higher operational impact during transition
Disadvantages:
⚠️ Security risk if private key is compromised
⚠️ Cannot change key length or algorithm
⚠️ Extends risk window for key material
When to use:
Emergency renewal near expiration
Temporary extension while planning full renewal
Small environments with limited certificate deployment
ITPROINSIGHTS Recommendation: Always use new key generation for scheduled CA renewals. Same-key renewal should be reserved for emergency scenarios only.
Part 1: Planning Your CA Renewal
Step 1: Assess Current PKI Environment
1.1 Inventory Current CA Configuration
Run this PowerShell script on your existing CA server:
\\powershell
CA Environment Discovery Script
Run with elevated privileges on CA server
$CAConfig = certutil -getconfig
$CAInfo = certutil -getreg CA
Write-Host "=== CA Configuration ===" -ForegroundColor Cyan
certutil -CAInfo
Write-Host "
Configuration exported to: $OutputPath" -ForegroundColor Green
\\
Expected output:
CA name and configuration
Certificate template list
Current CA certificate details and expiration date
CRL/AIA URL configuration
Count of active certificates
1.2 Document PKI Dependencies
Create a PKI dependency matrix:
System/Application
Certificate Type
Template Used
Owner/Contact
Impact if CA Unavailable
Domain Controllers
Computer
DomainController
IT Infrastructure
CRITICAL: Authentication fails
VPN Gateway
Server
WebServer
Network Team
HIGH: Remote access down
Exchange Server
Server
ExchangeServer
Messaging Team
HIGH: Email encryption broken
Web Applications
Server
WebServer
App Team
MEDIUM: HTTPS warnings
User Smart Cards
User
SmartCardLogon
Security Team
HIGH: MFA logon fails
1.3 Calculate Renewal Timeline
Use this renewal planning matrix:
Milestone
Timeline Before Expiration
Action Required
Initial Assessment
12 months
Document current PKI, assess dependencies
Renewal Planning
9 months
Define renewal strategy, procure hardware
Lab Testing
6 months
Build test CA environment, validate renewal procedures
Stakeholder Communication
6 months
Notify all certificate consumers, plan migration
Production Renewal
3 months
Execute CA renewal in production
Certificate Reissuance
2-3 months
Reissue all certificates from renewed CA
Old CA Decommission
1 month
Remove old CA after all certificates migrated
Warning: Attempting CA renewal with less than 3 months before expiration is high-risk. Emergency renewals often result in service outages and require same-key renewal (less secure).
Step 2: Design Your Renewal Strategy
2.1 Renewal Decision Matrix
Use this decision tree:
\ Is this an emergency renewal (< 3 months to expiration)?
├── YES → Same-key renewal (temporary)
│ Plan full new-key renewal for future
└── NO → New-key renewal (recommended)
├── Is key length/algorithm upgrade needed?
│ ├── YES → New key + upgrade (RSA 4096 or ECC)
│ └── NO → New key + same algorithm
└── Continue to planning phase
\\
2.2 Key Cryptographic Decisions
Decision Point
2026 Recommendation
Rationale
Root CA key algorithm
RSA 4096-bit or ECC P-384
Long-term security, wide compatibility
Issuing CA key algorithm
RSA 4096-bit or ECC P-256
Balance security and performance
Hash algorithm
SHA-256 or SHA-384
SHA-1 deprecated, SHA-256 industry standard
Key storage
Hardware Security Module (HSM) or TPM
Protect private keys from extraction
CRL signing algorithm
Same as CA certificate
Consistency and compatibility
Note: Elliptic Curve Cryptography (ECC) provides equivalent security to RSA at smaller key sizes (ECC P-256 ≈ RSA 3072-bit), improving performance. However, verify application compatibility before deploying ECC-based CAs.
2.3 Validity Period Planning
Root CA Certificate:
\\powershell
Calculate root CA expiration
$RootValidityYears = 20
$RootExpiration = (Get-Date).AddYears($RootValidityYears)
Write-Host "Root CA will expire on: $($RootExpiration.ToString('yyyy-MM-dd'))"
Rule: Root CA validity should be 2x issuing CA validity + 5 years buffer
$IssuingCAValidityYears = 7
$MinimumRootValidity = ($IssuingCAValidityYears * 2) + 5
if ($RootValidityYears -lt $MinimumRootValidity) {
Write-Warning "Root CA validity may be too short. Consider $MinimumRootValidity years or more."
}
\\
Issuing CA Certificate:
Standard: 5-7 years for enterprise environments
Extended: 10 years for stable, low-change environments (not recommended for internet-facing certificates)
Step 3: Create Detailed Renewal Plan
Download and complete this PKI Renewal Planning Worksheet:
PKI Renewal Planning Worksheet
Section 1: Current State Documentation
Current root CA certificate expiration date: _______________
Current issuing CA certificate expiration date: _______________
Backup: Integrated with enterprise backup solution
High Availability: Consider clustering or rapid restore capability
Tip: For high-availability scenarios, consider using Network Load Balancing with multiple issuing CAs or implement rapid CA restore procedures with frequent backups.
4.2 Pre-Installation Checklist
Root CA Server:
\\powershell
Run on root CA server BEFORE installing CA role
1. Set computer name (must not be domain-joined)
Rename-Computer -NewName "RootCA01"
2. Configure static IP (temporary, will be disconnected after setup)
6.6 Configure Certificate Templates and Auto-Enrollment
# Configure auto-enrollment for domain computers
# Run on domain controller or management workstation
# Install RSAT tools if needed
Install-WindowsFeature -Name GPMC, ADCS-Mgmt -IncludeManagementTools
# Configure Group Policy for auto-enrollment
# Create or edit domain-level GPO
$GPOName = "PKI Cert Auto-Enrollment"
New-GPO -Name $GPOName -Comment "Configures certificate auto-enrollment" | New-GPLink -Target "DC=contoso,DC=com"
# Enable auto-enrollment via PowerShell or Group Policy Editor:
# Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies
# - Certificate Services Client - Auto-Enrollment: Enable
# - Certificate Services Client - Certificate Enrollment Policy: Enable
# Verify certificate templates are published
certutil -CATemplates
# Publish specific templates
certutil -SetCATemplates +WebServer +Computer +User
# Force Group Policy update on test client
gpupdate /force
Verification checklist:
CA service is running and accessible
Root CA certificate is trusted by domain clients
CRL is published and accessible via HTTP and LDAP
Certificate templates are available
Auto-enrollment GPO is applied
Test certificate enrollment from domain-joined client
Part 3: Executing CA Certificate Renewal
Step 7: Renew Issuing CA Certificate with New Key
When your issuing CA certificate is approaching expiration (recommended: 6-12 months before expiry):
7.1 Pre-Renewal Backup
# Full backup of CA configuration and database
$BackupPath = "C:\PKI-Backup\Pre-Renewal-$(Get-Date -Format 'yyyyMMdd-HHmmss')"
New-Item -Path $BackupPath -ItemType Directory -Force
# Backup CA database
certutil -backup $BackupPath
# Backup registry settings
certutil -getreg CA > "$BackupPath\CA-Registry.txt"
# Export all certificate templates
certutil -CATemplates > "$BackupPath\CA-Templates.txt"
# System state backup
wbadmin start backup -backupTarget:E: -include:C: -allCritical -quiet
Write-Host "Pre-renewal backup completed: $BackupPath" -ForegroundColor Green
7.2 Generate New Key and Certificate Request
# Renew CA certificate with new key
certutil -renewCert ReuseKeys=False
# This generates a new certificate request file:
# C:\<CAName>.req
# Copy request to USB for transport to root CA
Copy-Item "C:\IssuingCA01.req" -Destination "E:\PKI\Renewal\" -Force
# Copy renewed certificate from USB
Copy-Item "E:\PKI\Renewal\IssuingCA01-Renewed.cer" -Destination "C:\PKI\Renewal\" -Force
# Install renewed CA certificate
certutil -installcert "C:\PKI\Renewal\IssuingCA01-Renewed.cer"
# Restart CA service
Restart-Service CertSvc
# Verify both old and new certificates are present
certutil -store my
# Publish new CRL
certutil -CRL
Step 8: Certificate Migration Strategy
After renewing the CA with a new key, you must migrate all issued certificates:
# Enable auto-renewal for computer and user certificates
# Via Group Policy:
# Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies
# Certificate Services Client - Auto-Enrollment:
# - Configuration Model: Enabled
# - Renew expired certificates, update pending certificates, remove revoked certificates: Checked
# - Update certificates that use certificate templates: Checked
# Force certificate renewal on domain clients
Invoke-Command -ComputerName (Get-ADComputer -Filter *).Name -ScriptBlock {
certutil -pulse
gpupdate /force
}
8.3 Manual Certificate Reissuance for Critical Systems
For systems that don't support auto-enrollment (network devices, applications):
# Revoke old certificate
certutil -revoke [SerialNumber] 6 # Reason: CeaseOfOperation
# Generate new certificate request (application/device-specific process)
# Submit to renewed CA
# Install new certificate on target system
# Update application configuration to use new certificate
Step 9: Decommission Old CA Certificate
After all certificates are migrated (typically 60-90 days):
# Verify no active certificates from old CA
$OldCert = certutil -store my
$OldCertSerial = "PASTE_OLD_CERT_SERIAL"
certutil -view -restrict "CertificateTemplate=*,NotAfter>=now" csv | Select-String $OldCertSerial
# If no results, safe to remove old CA certificate
certutil -delstore my $OldCertSerial
# Archive old CA certificate for compliance
Export-Certificate -Cert (Get-Item "Cert:\LocalMachine\My\$OldCertSerial") -FilePath "C:\PKI\Archive\OldCA-$(Get-Date -Format 'yyyyMMdd').cer"
# Force GPO update
gpupdate /force
# Trigger manual certificate enrollment
certutil -pulse
# Verify template permissions (Read and Enroll required for target group)
# Use Certificate Templates MMC: certtmpl.msc
# Right-click template > Properties > Security tab > Add "Domain Computers" with Read and Enroll permissions
# Restart certificate enrollment service
Restart-Service CertSvc
Issue 4: CA Service Won't Start
Symptom: CA service fails to start with error "The certificate for the Certificate Authority is not valid"
Diagnosis:
# Check CA certificate status
certutil -store my
# Review System Event Log
Get-EventLog -LogName System -Source CertificationAuthority -Newest 10
# Verify CA database integrity
certutil -verify C:\Windows\System32\CertLog\<CAName>.edb
Resolution:
# Restore CA from backup if database corrupt
certutil -restoreDB C:\PKI-Backup\[BackupFolder]
# If CA certificate missing, reinstall from exported copy
certutil -installcert "C:\PKI\IssuingCA\IssuingCA01.cer"
# Repair CA installation
Install-AdcsCertificationAuthority [parameters] -Force
# Check private key permissions
certutil -repairstore my [CertSerial]
Issue 5: Slow Certificate Issuance
Symptom: Certificate requests take several minutes to process
Certificate Practice Statement (CPS): Detailed operational procedures
Standard Operating Procedures (SOPs):
CA installation and configuration
Certificate issuance and revocation
Backup and restore procedures
Disaster recovery procedures
CA renewal procedures
Change Log: All PKI configuration changes with dates and approvals
Contact List: PKI team members, escalation procedures, vendor contacts
Compliance Mapping: PKI controls mapped to regulatory requirements
Conclusion
Deploying and maintaining an on-premises certificate authority infrastructure requires careful planning, rigorous execution, and ongoing maintenance. By following the procedures outlined in this guide, you can establish a secure, reliable PKI that meets enterprise requirements while minimizing operational risks.
Key Takeaways
Plan Ahead: Start CA renewal planning at least 12 months before expiration
Test Thoroughly: Validate all procedures in a lab environment first
Backup Everything: Maintain multiple backups before any PKI changes
New Keys Preferred: Use new key generation for scheduled renewals
Monitor Continuously: Implement automated monitoring for certificate health
A: Root CA: 15-20 years. Issuing CA: 5-7 years for enterprise environments. Plan renewal 12 months before expiration.
Q2: Can I upgrade from RSA 2048-bit to 4096-bit during renewal?
A: Yes! Renew with new key and specify 4096-bit key length. All issued certificates will need reissuance.
Q3: What happens if my CRL expires?
A: Certificate validation will fail for all certificates issued by that CA. Ensure CRL publication is automated and monitored.
Q4: Should I use OCSP or CRL for revocation checking?
A: Use both. CRL for offline scenarios, OCSP for real-time online validation. OCSP is faster but requires online connectivity.
Q5: How many issuing CAs do I need?
A: One issuing CA is sufficient for most organizations (<5,000 endpoints). Add additional issuing CAs for:
Geographic distribution (reduce latency)
Workload isolation (separate user certs from device certs)
High availability (multiple CAs behind load balancer)
Q6: Can I have both on-premises and cloud-based CAs?
A: Yes! Hybrid PKI architectures are common. Use on-premises CA for internal resources, cloud PKI (Azure Key Vault,AWS Private CA) for cloud-native applications.
Q7: What's the blast radius if my root CA is compromised?
A: Complete PKI failure. All certificates become untrustworthy. You must:
Revoke root CA certificate
Deploy new root CA (new keys)
Reissue all subordinate CA certificates
Reissue all endpoint certificates
This can take weeks/months. Hence the importance of keeping root CA offline and physically secured.
Q8: Do I need a CA for my home lab?
A: For production-like testing, yes. For casual lab work, self-signed certificates are sufficient. Consider using a dedicated lab CA with short-lived certificates.
Q9: How do I migrate from an old CA to a new CA?
A: Gradual approach:
Deploy new CA (don't remove old CA yet)
Publish both CA certificates to clients
Issue new certificates from new CA
Monitor old CA certificate expiration
After all certificates migrated, decommission old CA
Allow 60-90 days for full migration.
Q10: Can I use Elliptic Curve Cryptography (ECC) certificates for my CA?
A: Yes, but verify compatibility first. ECC P-256/P-384 provides strong security with better performance. However, some legacy applications don't support ECC. For maximum compatibility, use RSA 4096-bit.
IT Pro Insights (ITPROINSIGHTS.com) provides enterprise IT professionals with actionable technical content, in-depth tutorials, and industry analysis. This article is part of our Infrastructure & Operations and Security & Compliance content pillars.
Last Updated: March 16, 2026 Article Version: 1.0 Author: IT Pro Insights Technical Team Technical Reviewer: Pending Review Tested On: Windows Server 2022 Standard (Build 20348), Windows Server 2019 (Build 17763)
Did you find this guide helpful? Have questions or suggestions? Leave a comment below or contact us.
Follow us on LinkedIn | Twitter for more enterprise IT content.
Senior Cloud Engineer with 25+ years of hands-on experience across the datacenter-to-cloud stack: fiber SAN and disk storage, IBM/Lenovo blade and Dell/HP/Lenovo servers, Hyper-V and VMware clusters, and SQL and Remote Desktop Services (RDS) clusters. Deep in the Microsoft platform — Active Directory, PKI/certificate services, SQL, Power BI, Dynamics 365 Business Central (NAV) and AX (Axapta), Microsoft 365, Entra, and Intune — with a focus on Azure operations, FinOps, and applying AI tools like GitHub Copilot and Claude in real workflows. Writes practical, no-nonsense guides for IT professionals who need to ship real solutions.
Leave a Reply