The CIA also has its own certificate I would issues a certificate for itself a self signed certificate
while subordinate seize and get their certificates from a rootsy every C certificate has a validity
period usually when deployed in a rootsy idea.
Administrators choose to sell their validity period of the route C certificate for five years or more.
You need to run the USC certificate when the validity period is close to the expiration date.
SCA will there was an expired certificate cannot work.
Therefore you should not let the C certificate expire.
The validity period over the C certificate also is important for the certificates that the C issue of
SCA will never issue a certificate that has a longer validity time than its own certificate.
This is useful if you choose not to renew their C in the event that you want to decommission it.
For example when they see a certificate reaches the amount of its lifetime all of the certificates that
the now expired C has issued can no longer be used as well its security credentials this can have a
side effect when the C certificate lifetime comes close to expiration.
It will start to reduce the lifetime of certificates that it issues.
For example assume that you issuance C has a certificate certificate with five years of validity time
and it issued certificates with a two year lifetime for the first three years of its lifetime.
No problems will arise however after three years of this he will issue certificates with less than a
two year validity period.
Now some words about renewing rootsy certificates.
I would say usually has a certificate with a long validity period unlike a subordinate to it which by
default held a five year related to time.
You can set a March longer validity a time for a root C certificate during start up.
You should also select a longer key lands for the route C public and private key pairs.
If you use a long queue lands which makes the key more secure against brute force attack you increase
the length of time that the CIA can use the same private key.
In general greater rootsy that has a shorter validity period than the estimated lifetime or the key
with this in mind a reasonable strategy is to create a forty nine to six bid.
RSA key during route C is set up which reduces the need for frequent renewal.
Given the current state of computer technology Ford is 96 bit private keys secure from a brute force
attack for an estimated 15 20 years.
If you choose therefore to 96 bit key during the rootsy setup you then can create a root certificate
by using the forty nine to six build key that is valid for five years afterward you should renew their
C certificate every four years.
One year before the expiration of the validity period each time with a certificate validity of five
years every time you renew.
This is difficult.
It is recommended that you assess whether the same key given current computer technology and other security
considerations can be used with confidence for the next five years.
Now for a subordinate say that issue certificates to end user and devices.
It is a recommended strategy.
Might be to renew the C certificate regular rate with a new key six to twelve months before the out
of the C validity period.
This makes an attack on any one key less well able because any a compromised key would have a relatively
limited lifetime.
Zero management is another advantage of renewing a subordinate C by using a new key.
When do you ring USC with a new kid begins to publish a separate CRL for the revoked certificates it
has issued this year continues to publish their serial for certificates signed with the old key.
As long as the validity period of these certificates is well it however this can reduce the size of
a single CRL greatly and it will reduce the size of the CRL that the certificate where a fire has to
download.
When presented with a certificate from an issue and c you can complete the procedure for C certificate
renewal from the certification authority council.
You must stop I see a service before starting the renewal procedure.
When you start the procedure to renew or see a certificate from the certification authority council.
You will have to choose if you want to generate and UK asset or reuse the existing one.
For subordinate sees you you must submit a renewal request to the parent to see similar to when you
first issued the certificate so that's it for this lesson.
Next up will be talking about moving a a year to another computer.
I'll see you there.