KB ID 0001244
Problem
This is pretty much PART TWO of two posts addressing the need to migrate away from SHA1 before February 2017. Back in PART ONE we looked at how to upgrade the ROOT CA. It does not matter if it’s an offline or online root CA the process is the same. In many organisations their PKI is multi tiered, they either have a RootCA <> SubCA, or a ROOTCA <> IntermediateCA <> IssuingCA. (which is actually two SubCA’s).
Below I’ll run though the process to upgrade the SubCA once the RootCA has already been done, Ill also look at how that’s going to affect things like NDES (Network Device Enrolment System).
Solution
Before we think about SubCA’s the RootCA needs to be upgraded first, if it’s offline bring it online and follow the steps outlined in the previous article.
Certificate Services – Migrate from SHA1 to SHA2 (SHA256)
So your RootCA will now look like this before we start;
Note: If it’s normally offline leave it on, (we need it to issue the SubCA certificate).
The command to change the CA from SHA1 to SHA256 is the same one we used on the RootCA, you will then need to restart the Certificate Services.
[box]
certutil -setreg ca\csp\CNGHashAlgorithm SHA256 net stop certsvc net start certsvc
[/box]
As with the RootCA, we need to re-generate the CA certificate.
If your RootCA is online, and an Enterprise CA, you can submit the request directly to it, and skip the next few steps, but let’s take the ‘worst case’ scenario, and assume our Root CA is offline, (and even when online has no network connections) we have to do the submission manually, (via floppy disk).
Floppy Disks? What Year Is This? Well moving files between virtual machines is simple using virtual floppy disks, if you have physical machines, then you need to go hunting in drawers and cupboards!
Either way, we are doing this manually so select CANCEL.
Copy your certificate request from the root of the system drive to your floppy drive.
Then present the floppy to your RootCA, and issue the following command;
[box]
certreq -submit "A:\02-SUB-CA.cabench.com_cabench-02-SUB-CA-CA.req"
[/box]
You will be given a ‘RequestID‘, write it down, (you will need it in a minute). Leave the command window open!
In the Certificate Services Management Console > Open ‘Pending Requests’ > Locate the RequestID number you noted above, and issue the certificate.
Back at your command window, retrieve the certificate with the following command, (use the RequestID again);
[box]
certreq -retrieve 4 “A:\02-SUB-CA.cabench.com_cabench-02-SUB-CA-CA.crt”
[/box]
Take your floppy back to the SubCA, and install the certificate. (Change file types to ‘All Files’).
Now your SubCA is using a SHA256 certificate.
Repeat the process for any further SubCA’s
I Use NDES How Will That Be Affected?
Having had problems with certificates and NDES before, I was concerned about this the most, because I have to look after a lot of Cisco equipment, that gets certs from NDES, (or SCEP if you prefer). I’m happy to say NDES worked fine with SHA256 certificates. Below I successfully issued certs to a Cisco ASA (Running 9.2(4)).
Related Articles, References, Credits, or External Links
Certificate Services – Migrate from SHA1 to SHA2 (SHA256)
Windows Server 2012 – Install and Configure NDES
