Q: When is a validity period not a validity period?

A: When it’s a Certificate Authority after Windows 2000.

Back Story…

Those helpful chaps over at the Windows PKI Blog provided a script (setupca.vbs) to install a Certificate Authority on Windows Server 2008 and R2, and recently we had a request to be able to specify the expiration date of the CA’s own certificate (the default is 5 years).

In deconstructing the script to add this functionality I ran into a couple of issues which I thought it might be useful to share here…

From MSDN I found the ICertSrvSetup Interface which points to the method SetCASetupProperty, which is used to update a CASetupProperty.

So far, so good – the CASetupProperty typedef shows 2 properties of interest; ENUM_SETUPPROP_VALIDITYPERIOD and ENUM_SETUPPROP_VALIDITYPERIODUNIT.

First “gotcha” – the descriptions posted on MSDN for these 2 properties are backwards:

There is a reason for this – in Windows Server 2000 this is how it was, but from Windows Server 2003 onwards these got switched around.

If you check out the Ask the Directory Services Team blog you can see the definitions listed down in the CAPolicy.inf section where they talk about the history of RenewalValidityPeriod and RenewalValidityPeriodUnits along the same vein.

The second “gotcha” was due to VBScript not being strongly-typed – when trying to call SetCASetupProperty to specify SETUPPROP_VALIDITYPERIODUNIT was equal to 13 (as a test), the script engine kept falling over with error 0x80071707:
”The actual data type of the property did not match the expected data type of the property”

It seems my 13 wasn’t big enough :)

The original code looked like this:
Call g_oCASetup.SetCASetupProperty(SETUPPROP_VALIDITYPERIODUNIT, iSelectedValidYears)

To make it work, I needed to type-cast the variable to the expected VT_I4 type as defined by MSDN, using CLng():
Call g_oCASetup.SetCASetupProperty(SETUPPROP_VALIDITYPERIODUNIT, CLng( iSelectedValidYears ) )

With those wrinkles ironed out, the script ran happily with my new “/SV” switch to specify the validity period in years – the screenshot below shows the debug spew confirming that I was updating SETUPPROP_VALIDITYPERIODUNIT, and that the certificate produced was indeed valid for 13 years from the current date, using an 8K key length:

To avoid multiple copies of the same script floating around, requiring parallel updates if further changes are made in the future, I won’t post the whole script here, but I will document the bits I added so you can implement them in the setupca.vbs yourself if needed.

For each of the changes below, the lines in blue are from the original script, and the lines in red are the bits I inserted:

1. Add the documentation for the new switch:

 2. Add a constant to define SETUPPROP_VALIDITYPERIOD as years (for simplicity we won’t make this a variable):

3. Add a variable to hold the (optional) validity period specified at the command line:

 4. Add the debug output to confirm the specified validity period (if it was entered):

 5. Add the case to parse the command line switch “/SV”:

 6. Add the code to set the object properties SETUPPROP_VALIDITYPERIOD and SETUPPROP_VALIDITYPERIODUNIT:

The code above is very, very briefly tested on my W2K8R2 lab server and is provided “as-is”, without any liability or support.

There is no error or boundary checking done on the value entered.

Be careful of any inadvertent line-wrapping that may occur when viewed in small browser windows, VBScript is very unforgiving…