Blog Post

Ask the Directory Services Team
6 MIN READ

Migrating your Certification Authority Hashing Algorithm from SHA1 to SHA2

Jasben's avatar
Jasben
Icon for Microsoft rankMicrosoft
Apr 05, 2019
First published on TechNet on Apr 01, 2015     Hey all, Rob Greene here again. Well it’s been a very long while since I have written anything for the AskDS blog. I’ve been heads down supporti...
null
Updated Apr 22, 2025
Version 3.0
ca
Certificates
jasben
PKI
Rob Greene
guptaramkumar52's avatar
guptaramkumar52
Copper Contributor
Jun 07, 2025

Can anyone help with how to migrate PKI RSA key size from 2048 to 4096. I tried a lot on the internet however didn't find anywhere relevant. below are some more details regarding infra. how to fulfill it? 

 

 In the infra there is one offline Root CA and two subordinate online CA which are on RSA 2048 key current key is used 2048 on Root and Subordinate CAs. 

Savannah_Greene's avatar
Savannah_Greene
Icon for Microsoft rankMicrosoft
Jun 09, 2025

guptaramkumar52​ 

You will have to create a CAPolicy.inf file, and put it in the %SystemRoot% folder on the CA before attempting to renew to the CA.

 

You can review this blog on the CAPolicy.inf file.  
Windows Server 2008 R2 CAPolicy.inf Syntax | Microsoft Community Hub

the format is similar to the below:

[Version]
Signature="$Windows NT$"

[certsrv_server]
RenewalKeyLength= 4096 
RenewalValidityPeriod= Years
RenewalValidityPeriodUnits= 5