Mastering Active Directory - Second Edition

CA and CRL time limits

The CA and CRL time limits also need to be adjusted. This can be done using the following commands:

certutil -setreg CA\CRLPeriodUnits 7certutil -setreg CA\CRLPeriod "Days"certutil -setreg CA\CRLOverlapPeriodUnits 3certutil -setreg CA\CRLOverlapPeriod "Days"certutil -setreg CA\CRLDeltaPeriodUnits 0certutil -setreg ca\ValidityPeriodUnits 3certutil -setreg ca\ValidityPeriod "Years"

Once all this is done, in order to complete the configuration, restart the certificate service using the following command:

restart-service certsvc

Last but not least, run the following command to generate the CRLs:

certutil -crl

Once all of this is done, we can run PKIView.msc to verify the configuration:

PKIView.msc was first introduced ...