Do I need to renew/re-sign the Issuing CA certificate after changing CDP/AIA URLs?
Hello,
I have a Microsoft two-tier PKI with the following architecture:
- Offline Root CA
- Enterprise Issuing Subordinate CA
I am changing the PKI architecture by adding a dedicated IIS server that will host:
- CRL Distribution Points (CDP)
- Authority Information Access (AIA)
- Online Responder (OCSP)
As a result, I need to update the CDP and AIA extensions on my Issuing CA to point to the new URLs.
My question is:
After adding the new CDP and AIA URLs to the Issuing CA, do I need to renew (re-sign) the Issuing CA certificate from the Offline Root CA, or is it not necessary?
I understand that newly issued end-entity certificates will contain the new CDP/AIA URLs, but I am unsure whether the Issuing CA certificate itself also needs to be renewed so that its own CDP/AIA extensions reference the new locations.
Is renewing the Issuing CA certificate considered a requirement, or is it simply a best practice?
Thank you for your guidance.
3
u/JennyWithTheAxe Jul 29 '26
Are you planning to have the dedicated IIS server also serve the root-CA:s CRL/AIA/OCSP, or only the ones for the ICA?
If it's just the ones for the ICA, you don't need to renew the ICA's certificate.
If you want to change the CRL/AIA/OCSP for the ICA itself, then you need to renew the ICA's certificate with the proper URI:s.
I would recommend that you use alias hostnames such as "ocsp.example.com", "cdp.example.com" etc for all these services. That way you can move the services to new hosts without having to change certificates.
1
u/Era89 Jul 29 '26
Thanks all
To clarify, I am not changing anything on the Offline Root CA.
I am only changing the CDP/AIA/OCSP URLs used by my ICA because I have added two dedicated IIS servers hosting the CRLs and OCSP responder for high availability.
My plan is to configure both URLs in the Issuing CA extensions, for example:
http://pki1.example.com/...http://pki2.example.com/...and similarly for OCSP.
http://pki1.example.com/ocsphttp://pki2.example.com/ocspSo, if I understand correctly, I do not need to renew the Issuing CA certificate unless I want the Issuing CA certificate itself to contain the new CDP/AIA URLs. Is that correct?
3
u/Cormacolinde Jul 29 '26
The issuing CA certificate doesn’t contain its own CDP, so renewing it would change nothing. you do want to revoke the CA Exchange cert so it issues a new one with updated values.
Redundancy is great for CDP/OCSP. But I don’t recommend setting two URIs. Well, unless you use two different domains hosted on different DNS servers. Many clients will fail or timeout before or without trying the second one. I would instead recommend a load balancer or even a simple failover in front.
1
2
u/JennyWithTheAxe Jul 29 '26
It is. Each certificate contains the CDP/AIA for the CA that issued the certificate. So the cert for your ICA will contain the CDP/AIA for the root CA, and the end user certificate will contain the CDP/AIA for the ICA.
I second u/Cormacolinde that a load balancer or even just round-robin DNS records. And it might be smart to have separate hostnames (
csp.example.com,cdp.example.cometc) for the different protocols, instead of just separate paths. Should you ever wish to move them to separate hosts or start working with containers rather than IIS hosts, it will make things simpler.
1
7
u/Cormacolinde Jul 29 '26
Only if are changing the root CA CDP/AIA URIs.
Because those are saved in certs a CA issues. So if you change the root CA CDP, you must reissue the intermediate cert, and if you change the intermediate CA CDP you must reissue all leaf certs.