Hello,
I am deploying two-tier hierarchy (Root CA - Standalone Root, Issuing CA - Enterprise CA on Active Directory).
Root CA CAPolicy.inf
[Version]
Signature= "$Windows NT$"
[certsrv_server]
RenewalKeyLength=4096
RenewalValidityPeriodUnits=20
RenewalValidityPeriod=years
CRLPeriod=weeks
CRLPeriodUnits=26
CRLOverlapPeriod=weeks
CRLOverlapUnits=2
CRLDeltaPeriodUnits=0
CRLDeltaPeriod=days
Sub CA CAPolicy.inf
[Version]
Signature = "$Windows NT$"
[PolicyStatementExtension]
Policies = SomeCompany
Critical = FALSE
[SomeCompany]
Notice=SomeCompany Certification Practice Statement
URL = http://cert.companydomain/pki/policies
OID = 2.5.29.32.0 ; All Issuance Policy
[certsrv_server]
RenewalKeyLength = 4096
RenewalValidityPeriodUnits = 5
RenewalValidityPeriod = years
CRLPeriodUnits = 1
CRLPeriod = weeks
CRLOverlapUnits = 1
CRLOverlapPeriod = days
CRLDeltaPeriodUnits = 12
CRLDeltaPeriod = hours
Root CA Config Script
certutil -setreg CA\DSConfigDN CN=Configuration,DC=<domain>
certutil -setreg CA\CRLPublicationURLs "65:%WINDIR%\system32\CertSrv\CertEnroll\%3%8%9.crl\n2:http://cert.companydomain/pki/<name>%8.crl"
certutil -setreg CA\CACertPublicationURLs "1:%WINDIR%\system32\CertSrv\CertEnroll\%1_%3%4.crt\n2:http://cert.companydomain/pki/<name>%%4.crt\n32:http://cert.companydomain/ocsp"
certutil -setreg CA\ValidityPeriodUnits 20
certutil -setreg CA\ValidityPeriod "Years"
certutil -setreg CA\CRLPeriodUnits 26
certutil -setreg CA\CRLPeriod "Weeks"
certutil -setreg CA\CRLDeltaPeriodUnits 0
certutil -setreg CA\CRLDeltaPeriod "Days"
certutil -setreg CA\CRLOverlapUnits 2
certutil -setreg CA\CRLOverlapPeriod "Weeks"
certutil -setreg CA\AuditFilter 127
certutil -v -setreg policy\editflags +EDITF_ENABLEOCSPREVNOCHECK
net stop certsvc & net start certsvc
certutil –CRL
I then copied the root CA certificate and CRL to Issuing CA and using the following commands
certutil –addstore –f Root rootca.crt
certutil –addstore –f Root rootca.crl
certutil -dspublish -f rootca.crt RootCA
certutil -dspublish -f rootca.crl RootCA
All steps to deploying looks fine but if we trying to install CA certificate on Issuing CA *.p7b (early successfully issued and exported on Root CA) when appears error:
"The new Certification Authority certificate cannot be installed because the CA Version extension is incorrect.The most recently generated request file should be used to obtain the new certificate:
C:\****-CA(1).req The data is invalid. 0x8007000d (WIN32: 13 ERROR_INVALID_DATA)"
and application error event 27:
"Active Directory Certificate Services did not start: Hierarchical setup is incomplete. Use the request file in C:\***-CA.req.req to obtain a certificate for this Certificate Server, and use the Certification Authority administration tool to install
the new certificate and complete the installation."
Part of request file:
.........
Request Attributes: 2
2 attributes:
Attribute[0]: 1.3.6.1.4.1.311.13.2.3 (OS Version)
Value[0][0], Length = d
6.3.9600.2.
Attribute[1]: 1.2.840.113549.1.9.14 (Certificate Extensions)
Value[1][0], Length = 129
Unknown Attribute type
Certificate Extensions: 6
1.3.6.1.4.1.311.21.1: Flags = 0, Length = 3
CA Version
V0.0
2.5.29.14: Flags = 0, Length = 16
Subject Key Identifier
7e 17 22 b1 40 7c 24 f3 4b 8f d1 f5 5f 04 d0 23 43 f5 c1 cd
2.5.29.32: Flags = 0, Length = b0
Certificate Policies
[1]Certificate Policy:
Policy Identifier=All issuance policies
[1,1]Policy Qualifier Info:
Policy Qualifier Id=User Notice
Qualifier:
Notice Text=SomeCompany Certification Practice Statement
[1,2]Policy Qualifier Info:
Policy Qualifier Id=CPS
Qualifier:
http://cert.companydomain/pki/policies
1.3.6.1.4.1.311.20.2: Flags = 0, Length = c
Certificate Template Name (Certificate Type)
SubCA
2.5.29.15: Flags = 0, Length = 4
Key Usage
Digital Signature, Certificate Signing, Off-line CRL Signing, CRL Signing (86)
2.5.29.19: Flags = 1(Critical), Length = 5
Basic Constraints
Subject Type=CA
Path Length Constraint=None
...............
If I trying to start Certification Authority service on Issuing CA appears error: "The certificate for the CA "Company Sub CA" on domainhostname is missing. Do you want to install this certificate?" and when after selecting the certificate appears error with incorrect CA version.
So, if anyone can help me to resolve the problem I would be very grateful.
Many thanks in advance. Have a nice day)