Do Existing Domain Controllers Need New Multi-SAN Certificates When Adding More DCs?
Asked by
MellowPine47
I currently have three domain controllers and plan to add a fourth, then a fifth, while eventually demoting the original two. I need certificates for the new domain controllers, possibly for LDAPS or related authentication services. If I obtain a multi-SAN certificate for the new servers, do I also need to replace the certificates already installed on the existing three domain controllers? Our university provides the certificates at no cost, but they now have relatively short validity periods, so I'd prefer not to renew certificates unnecessarily. The existing certificates have worked without problems, although I'm not completely certain which services depend on them.
Answers
You don’t need one certificate covering every domain controller unless a particular application specifically requires that setup. Issue or install a certificate for each new DC with the appropriate DNS names and intended usage, while leaving the current certificates in place until they expire or the servers are decommissioned.
Reply to this answer
If these certificates are for LDAPS, each domain controller can generally use its own certificate. The certificate should contain that server’s fully qualified domain name in the subject or SAN, and the certificate chain must be trusted by the clients connecting to it. Adding a certificate for a new domain controller does not normally require replacing the certificates on the existing controllers.
Reply to this answer
First confirm what is actually using the certificates. If this is only for LDAPS, check that the certificates have the server FQDN in the SAN, include the appropriate Server Authentication usage, and chain to a CA trusted by the clients. The short certificate lifetime makes automated enrollment or renewal worth considering, but it still doesn’t mean the older DC certificates must be replaced just because new controllers are being added.
Reply to this answer
Add your answer
Answers are reviewed before publication.
MellowPine47: That makes sense. We aren’t running Active Directory Certificate Services, and the certificates were mainly installed as part of the previous administrator’s LDAPS process. I’ll verify the services and names covered before issuing certificates for the new controllers.