<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
On 11/05/2012 11:40 AM, Rob Crittenden wrote:
<blockquote cite="mid:50981616.6080308@redhat.com" type="cite">Here
is the same question I asked last week, this time by someone
planning ahead. <br>
<br>
They have an externally-signed IPA dogtag CA whose external CA
expires soon. How do they go about renewing things? I assume they
need to renew the external CA first. Does it make a difference if
the external CA is rekeyed? <br>
</blockquote>
<br>
Unless there is a legitimate concern about key exposure, or there is
a policy regarding how long a CA signing key pair can be used, in
general, renewing a CA signing certificate with the same key pair is
a much simpler.<br>
Here is a link on how to do so:<br>
<a class="moz-txt-link-freetext"
href="https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Certificate_System/8.1/html/Admin_Guide/managing-ca-related-profiles.html">https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Certificate_System/8.1/html/Admin_Guide/managing-ca-related-profiles.html</a><br>
look under <br>
2.7.3. Allowing a CA Certificate to Be Renewed Past the CA's
Validity Period<br>
<br>
Things are a bit more complicated if a CA is "re-keyed". This is
because of the need to populate the new trust and maintain the old,
the continued support of revocation with the old, and then there is
also dual generation of CRL's etc. It's more of a hassle in a
deployment, but of course not undoable.<br>
<br>
Christina<br>
<br>
<br>
<blockquote cite="mid:50981616.6080308@redhat.com" type="cite"> <br>
rob <br>
<pre wrap=""><fieldset class="mimeAttachmentHeader"></fieldset>
_______________________________________________
Pki-devel mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Pki-devel@redhat.com">Pki-devel@redhat.com</a>
<a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/pki-devel">https://www.redhat.com/mailman/listinfo/pki-devel</a></pre>
</blockquote>
<br>
</body>
</html>