With the recent announcement of drastically reduced certificate lifetimes for public TLS certificates, there has been much discussion about certificate lifetimes for private certification authorities (CAs) like Microsoft Active Directory Certificate Services (AD CS). Most commonly, AD CS certificates are issued with a one-year validity period. However, as I’ve discussed in the past, there’s good reason to consider shorter lifetimes in many scenarios. Reducing certificate lifetimes is a growing trend to enhance security, but it poses challenges for private CAs like AD CS. This post explains how to manage shorter certificate lifetimes in Intune using PKCS and SCEP.
AD CS Template
With AD CS, the administrator defines the certificate lifetime by setting the validity period value when creating the certificate template in Active Directory (AD), as shown here.
All certificates issued using this template will be valid for one year from the date of issuance.
Note: The only exception would be if the issuing CA’s certificate were due to expire before the one-year expiration date. In that case, the certificate would be valid until the CA certificate expires.
Intune PKCS and SCEP
When issuing certificates with Intune using either PKCS or SCEP, administrators deploy an Intune enrollment certificate template in AD that Intune uses for user and device certificate enrollment. While the Intune enrollment certificate template defines the default validity period, Intune also allows administrators to specify a desired validity period in the PKCS or SCEP policy settings, as shown here.
Intune Validity Period and AD CS
Although Intune provides the ability to define the validity period on the PKCS or SCEP policy, AD CS does not honor this setting unless explicitly configured to do so. Instead, it defaults to the period defined in the certificate template. Using the example above, the administrator defined a validity period of 1 month. However, since the Intune enrollment certificate template’s validity period was set to one year, a certificate valid for one year will be issued.
Override Template Settings
Fortunately, there is a way to override this default behavior. On the issuing CA where the Intune enrollment certificate template is published, open an elevated PowerShell command window and run the following command.
certutil.exe -setreg Policy\EditFlags +EDITF_ATTRIBUTEENDDATE
Once complete, run the following PowerShell command to restart the CA service.
Restart-Service -Name CertSvc -PassThru
After making this change, administrators can define a shorter certificate validity period than specified on the template using Intune PKCS and SCEP policies.
Note: For security reasons, this setting only allows requests that are shorter than the template’s defined validity period. You cannot request a certificate with a validity period that is longer than the template allows.
Summary
By enabling the EDITF_ATTRIBUTEENDDATE flag on your issuing CA, you gain flexibility to tailor certificate validity periods per use case—while still enforcing a maximum validity via the AD Intune certificate enrollment template. Flexible certificate validity periods are especially valuable in environments that are moving toward short-lived certificates for improved security posture.
Additional Information
TLS Certificate Lifetimes Will Officially Reduce to 47 Days
Always On VPN SSTP and 47-Day TLS Certificates
The Case for Short-Lived Certificates in Enterprise Environments
Mastering Certificates with Microsoft Intune – Live Online Training
