Windows 2008 R2 pki question

hello

i have 2 tiered pki structure. 1 offline standard root ca.  , 2 enterprise issuing subordinate ca.  of them running microsoft software key storage provider 256 hash algorithm. also new certs issued issuing ca has hash256. root ca , intermediate subordinate certs on sha1 though actual web server cert has hash256 . an error on chrome running sha1.  if renew root , subordinate ca cert error go away?

also understand enterprise sub ca send new intermediate root cert automatically computers in domain.  but how push offline root ca cert computers in domain. when issue new cert, have new intermediate cert , root cert in chain?  what best solution address this

thanks

> how push offline root ca cert computers in domain

you can use certutil:

certutil -dspublish -f cacertfile.crt rootca

, after group policy update clients receive new root ca certificate.

---

vadims podāns, aka powershell cryptoguy
weblog: www.sysadmins.lv
powershell pki module: pspki.codeplex.com
check out new: ssl certificate verifier
check out new: powershell file checksum integrity verifier tool.

Windows Server  >  Security