http://blogs.technet.com/b/pki/archive/2011/08/08/active-directory-certificate-services-frequently-asked-questions-needs-your-help.aspxIf you have commonly asked questions about certificate services or PKI that you think should be listed in the Active Directory Certificate Services Frequently Asked Questions (AD CS FAQ ) list, I encourage you to submit them to the TechNet Wiki postingen-USTelligent Evolution Platform Developer Build (Build: 5.6.50428.7875)http://blogs.technet.com/b/pki/archive/2011/08/08/active-directory-certificate-services-frequently-asked-questions-needs-your-help.aspx#3477083Wed, 25 Jan 2012 00:25:30 GMTd5e57398-b9ef-4490-9955-07cbb4e4a80d:3477083Kurt L Hudson MSFT<p>Right now the ASKDS blog (<a rel="nofollow" target="_new" href="http://blogs.technet.com/b/askds/">blogs.technet.com/.../askds</a>) has good information about migrating certification authorities, especially the single to multiple tier migration.</p> <p><a rel="nofollow" target="_new" href="http://blogs.technet.com/b/askds/archive/2011/11/11/friday-mail-sack-guest-reply-edition.aspx#camig">blogs.technet.com/.../friday-mail-sack-guest-reply-edition.aspx</a></p> <p><a rel="nofollow" target="_new" href="http://blogs.technet.com/b/askds/archive/2010/08/23/moving-your-organization-from-a-single-microsoft-ca-to-a-microsoft-recommended-pki.aspx">blogs.technet.com/.../moving-your-organization-from-a-single-microsoft-ca-to-a-microsoft-recommended-pki.aspx</a></p> <p>As for the renewing the issuing CA certificates, you just need to duplicate the Subordinate Certification Authority template, make your modifications, then Issue that template. Finally, use the option to Renew the CA Certificate in the Issuing CA Certification Authority console.</p> <div style="clear:both;"></div><img src="http://blogs.technet.com/aggbug.aspx?PostID=3477083" width="1" height="1">http://blogs.technet.com/b/pki/archive/2011/08/08/active-directory-certificate-services-frequently-asked-questions-needs-your-help.aspx#3476842Mon, 23 Jan 2012 20:40:52 GMTd5e57398-b9ef-4490-9955-07cbb4e4a80d:3476842Tom L<p>I spent a couple of months looking over documentation and other blog postings about upgrading the servers that run our PKI. &nbsp;I specifically was looking to move our Enterprise Root CA to a Stand-Alone Root CA. &nbsp;I pulled it off, but finding the documentation was not easy to do. &nbsp;I now need to find a way to make our Issuing CA&#39;s renew or acquire a subCA certificate that is longer than the riginal 2 years.</p> <div style="clear:both;"></div><img src="http://blogs.technet.com/aggbug.aspx?PostID=3476842" width="1" height="1">http://blogs.technet.com/b/pki/archive/2011/08/08/active-directory-certificate-services-frequently-asked-questions-needs-your-help.aspx#3469842Thu, 08 Dec 2011 19:28:38 GMTd5e57398-b9ef-4490-9955-07cbb4e4a80d:3469842cr0m<p>One thing I found myself doing before I even started my build was to go out and try and find horror stories. For example, some people just want to know... Are there any dangers to installing the Enterprise Issuing CA? Can it affect logins? Could it render the domain unusble. I think a good outline of potential risks and &quot;gotchas&quot; would be nice to read.</p> <div style="clear:both;"></div><img src="http://blogs.technet.com/aggbug.aspx?PostID=3469842" width="1" height="1">http://blogs.technet.com/b/pki/archive/2011/08/08/active-directory-certificate-services-frequently-asked-questions-needs-your-help.aspx#3445915Tue, 09 Aug 2011 00:01:12 GMTd5e57398-b9ef-4490-9955-07cbb4e4a80d:3445915ADCS Answers ADCS FAQ<p>You should also associate the AD CS FAQ with ADCS FAQ, ADCS Answers, and AD CS Answers.</p> <p><a rel="nofollow" target="_new" href="http://social.technet.microsoft.com/wiki/contents/articles/ad-cs-faq.aspx">social.technet.microsoft.com/.../ad-cs-faq.aspx</a></p><div style="clear:both;"></div><img src="http://blogs.technet.com/aggbug.aspx?PostID=3445915" width="1" height="1">