%3CLINGO-SUB%20id%3D%22lingo-sub-1129039%22%20slang%3D%22en-US%22%3ERenew%20Web%20Server%20(SSL)%20Certificates%20Automatically%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1129039%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSTRONG%3E%20First%20published%20on%20TECHNET%20on%20Aug%2027%2C%202013%20%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3EWorking%20with%20Internet%20Information%20Services%20(IIS)%20certificates%20can%20be%20a%20bit%20challenging%20especially%20during%20renewal%20time.%20Most%20organizations%20do%20not%20track%20Web%20SSL%20certificates%20which%20in%20turn%20might%20expire%20and%20cause%20an%20unplanned%20outage.%20Those%20who%20track%20this%20information%20on%20the%20other%20hand%2C%20have%20to%20make%20sure%20certificate%20are%20renewed%20before%20their%20expiration%20period%20or%20find%20ways%20to%20notify%20the%20application%20owners%20of%20their%20certification%20expiration%20beforehand.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWindows%20Server%202008%20R2%20and%20Windows%20Server%202012%20addresses%20this%20issue%20through%20Auto-enrollment%20and%20Certificate%20Templates.%20The%20Certificate%20Template%E2%80%99s%20design%20includes%20a%20new%20option%20%3CSTRONG%3E%20Use%20subject%20information%20from%20existing%20certificates%20for%20autorenewal%20requests.%20%3C%2FSTRONG%3E%20This%20option%20allows%20the%20certificate%20to%20renew%20automatically%2C%20including%20any%20information%20in%20the%20%3CSTRONG%3E%20Subject%20Name%20%3C%2FSTRONG%3E%20%2C%20or%20any%20additional%20information%20in%20%3CSTRONG%3E%20Subject%20Alternate%20Names%20%3C%2FSTRONG%3E%20fields.%20This%20option%20is%20available%20for%20client%20certificates%20installed%20on%20computers%20running%20Windows%207%20or%20Windows%20Server%202008%20R2%20and%20later.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20416px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F167226iD21E0CB5244A7A17%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20%3CSTRONG%3E%20Use%20subject%20information%20from%20existing%20certificates%20for%20autoenrollment%20renewal%20requests%20%3C%2FSTRONG%3E%20option%20causes%20the%20certificate%20enrollment%20client%20to%20read%20subject%20name%20and%20subject%20alternative%20name%20information%20from%20an%20existing%20computer%20certificate%20based%20on%20the%20same%20%3CBR%20%2F%3Ecertificate%20template%20when%20creating%20renewal%20requests%20automatically%20or%20using%20the%20Certificates%20snap-in.%20This%20applies%20to%20computer%20certificates%20that%20are%20expired%2C%20revoked%2C%20or%20within%20their%20renewal%20period.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20-ERR%3AREF-NOT-FOUND-%20Autoenrollment%20Group%20Policy%20%20has%20to%20be%20enabled%20for%20this%20feature%20to%20work.%20This%20feature%20will%20also%20work%20on%20certificates%20issued%20prior%20to%20enabling%20it.%20For%20example%2C%20an%20administrator%20can%20change%20the%20original%20template%E2%80%99s%20settings%20to%20include%20%3CSTRONG%3E%20Use%20subject%20information%20from%20existing%20certificates%20for%20autoenrollment%20renewal%20updates%20%3C%2FSTRONG%3E%20after%20a%20certificate%20is%20issued%20because%20the%20scope%20of%20enrollment%20in%20a%20Microsoft%20PKI%20is%20the%20template.%20Autoenrollment%20Group%20Policy%20and%20this%20feature%20will%20allow%20the%20certificate%20to%20renew%20in%20the%20future%20without%20any%20administrative%20intervention%20when%20the%20certificate%20is%20within%20the%20renewal%20validity%20period%20time%20specified%20by%20the%20template%20%E2%80%93%20typically%20within%2020%25%20or%20less%20of%20the%20certificate%E2%80%99s%20validity%20period.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAmer%20F%20Kamal%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ESenior%20Premier%20Field%20Engineer%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-1129039%22%20slang%3D%22en-US%22%3E%3CP%3EFirst%20published%20on%20TECHNET%20on%20Aug%2027%2C%202013%20Working%20with%20Internet%20Information%20Services%20(IIS)%20certificates%20can%20be%20a%20bit%20challenging%20especially%20during%20renewal%20time.%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1129039%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAmerKamal%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Microsoft

First published on TECHNET on Aug 27, 2013

Working with Internet Information Services (IIS) certificates can be a bit challenging especially during renewal time. Most organizations do not track Web SSL certificates which in turn might expire and cause an unplanned outage. Those who track this information on the other hand, have to make sure certificate are renewed before their expiration period or find ways to notify the application owners of their certification expiration beforehand.

 

Windows Server 2008 R2 and Windows Server 2012 addresses this issue through Auto-enrollment and Certificate Templates. The Certificate Template’s design includes a new option Use subject information from existing certificates for autorenewal requests. This option allows the certificate to renew automatically, including any information in the Subject Name , or any additional information in Subject Alternate Names fields. This option is available for client certificates installed on computers running Windows 7 or Windows Server 2008 R2 and later.

 

 

 

 

The Use subject information from existing certificates for autoenrollment renewal requests option causes the certificate enrollment client to read subject name and subject alternative name information from an existing computer certificate based on the same
certificate template when creating renewal requests automatically or using the Certificates snap-in. This applies to computer certificates that are expired, revoked, or within their renewal period.

 

The Autoenrollment Group Policy has to be enabled for this feature to work. This feature will also work on certificates issued prior to enabling it. For example, an administrator can change the original template’s settings to include Use subject information from existing certificates for autoenrollment renewal updates after a certificate is issued because the scope of enrollment in a Microsoft PKI is the template. Autoenrollment Group Policy and this feature will allow the certificate to renew in the future without any administrative intervention when the certificate is within the renewal validity period time specified by the template – typically within 20% or less of the certificate’s validity period.

 

Amer F Kamal

 

Senior Premier Field Engineer