I currently have three domain controllers and plan to add a fourth, then possibly a fifth, while eventually demoting the first two. The new servers will need certificates with the appropriate subject alternative names. If I obtain a new multi-SAN certificate for the incoming domain controllers, do I also need to replace the certificates already installed on the existing three? These certificates are issued by an external trusted provider, not self-signed or issued by Active Directory Certificate Services. They have mainly been used for authentication, and the certificate lifetimes are becoming shorter, so I would prefer not to renew certificates on servers that already have valid one-year certificates.
2 Answers
You generally do not need to update the certificates on the existing domain controllers. Each controller can use its own certificate, provided it is currently valid, trusted by the clients, and includes that server’s fully qualified domain name in the subject or SAN. The new certificate only needs to cover the names used by the new controllers. If this is specifically for LDAPS, make sure the certificate has the server authentication EKU and that clients connect using a name present on the certificate.
First confirm what service actually needs the certificates. For LDAPS, every domain controller accepting TLS connections needs its own suitable certificate; issuing one multi-SAN certificate for several machines is possible, but separate certificates are often easier to manage. Existing certificates can remain in place until they expire or are replaced, as long as their names, trust chain, and intended usage are correct.
That makes sense. I was mainly concerned that adding the new controllers would require all of the existing certificates to be replaced at the same time.