Do I need to renew/re-sign the Issuing CA certificate after changing CDP/AIA URLs?

Yassine El Yakoubi 20 Reputation points
2026-07-29T11:12:51.83+00:00

Hello,

I have a Microsoft two-tier PKI with the following architecture:

  • Offline Root CA
  • Enterprise Issuing Subordinate CA

I am changing the PKI architecture by adding a dedicated IIS server that will host:

  • CRL Distribution Points (CDP)
  • Authority Information Access (AIA)
  • Online Responder (OCSP)

As a result, I need to update the CDP and AIA extensions on my Issuing CA to point to the new URLs.

My question is:

After adding the new CDP and AIA URLs to the Issuing CA, do I need to renew (re-sign) the Issuing CA certificate from the Offline Root CA, or is it not necessary?

I understand that newly issued end-entity certificates will contain the new CDP/AIA URLs, but I am unsure whether the Issuing CA certificate itself also needs to be renewed so that its own CDP/AIA extensions reference the new locations.

Is renewing the Issuing CA certificate considered a requirement, or is it simply a best practice?

Thank you for your guidance.

Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
0 comments

Answer accepted by question author

Steven Nguyen (WICLOUD CORPORATION) 415 Reputation points Microsoft External Staff Moderator
2026-07-30T01:23:55.5666667+00:00

Hi Yassine El Yakoubi,

To answer your question directly: No, renewing the Issuing CA certificate is not strictly necessary simply because you updated the CDP and AIA extensions on the Issuing CA. However, depending on what happens to your old HTTP server, it might become a strict requirement.

Here is the architectural explanation:

According to X.509 standards (RFC 5280), the CDP and AIA extensions embedded inside a certificate are dictated by the CA that issued it, not the subject itself.

When you update the extensions on your Issuing CA, you are only changing the URLs that will be stamped into newly issued End-Entity certificates.

  • The Issuing CA's own certificate was issued by your Offline Root CA. Therefore, the CDP and AIA URLs embedded inside the Issuing CA certificate point to the locations defined by the Offline Root CA at the time it was signed.

A. When is renewal NOT necessary?

If the old web server hosting your Offline Root CA's CRL and CRT files remains online and accessible to all clients, you do not need to renew the Issuing CA certificate. The CryptoAPI chain validation engine will successfully validate the Sub CA using the old URLs, and validate end-entities using the new IIS URLs.

B. When does renewal become a STRICT REQUIREMENT?

If you plan to decommission the old web server and consolidate all PKI files (including the Offline Root CA's CRL and CRT) onto the new dedicated IIS server, the old URLs embedded in the Issuing CA certificate will break. If clients cannot download the Root CRL, the entire certificate chain validation will fail.

If you are decommissioning the old server, you MUST perform the following steps:

  • Turn on the Offline Root CA.
  • Update the CDP and AIA extension configurations on the Offline Root CA to point to the new dedicated IIS server URLs.
  • Publish a new Root CRL and copy both the Root CRL and Root CRT to the new IIS server.
  • Renew the Issuing CA certificate (re-sign it with the Offline Root CA) so it receives the new CDP/AIA URLs.

===========================

Hope this will help with your queries. If this helps resolve your problem, please consider hitting "Accept Answer" so other users facing this failure can easily find the solution!

Was this answer helpful?

2 people found this answer helpful.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.