Is validity offset applicable for CA or suCA ?

[younid]

Hello,

I'm working with EJBCA CE version 7.11 and I'm trying to create a CA or subCA with undefined validity period.
It works for the noAfter but not for notBefore date.

According to the documentions from this page : https://doc.primekey.com/ejbca/ejbca-operations/ejbca-ca-concept-guide/certificate-profiles-overview/certificate-profile-fields#CertificateProfileFields-UndefinedValidity
It is possible to set an offset for the notBefore date but this is working only for leaf certificates.
Creation of CA of subCA applies only the notAfter parameter.

Could you please help to understand what I did wrong of not correctly understood ?

Regards,
Younid

[primetomas]

It sounds like you are creating the Root CA and SubCA on the same system/EJBCA instance, is that correct and as planned?

[younid]

Hi @primetomas,

Yes this is correct, I created the Root CA and SubCA on the same EJBCA.
This is as planned. In fact I have several SubCAs and some of them need to have a validity period few years in the past and indefinite validity in the futur.
Using the end date field works fine as described in the documenation.
Using the offset parameter (i.e. -2mo) is not giving any effect.
The SubSA is generated but it have only the end date with the exepcted value. not before part is ignored.

Is there any additional parameter that must be enable or changed to have this date in the past applied ?

Regars,
Younid

[younid]

Hi @primetomas,

Do you think this is possible or is there any restriction I did not found in the documentation ?
Please help me to fixe this point which is blocking point for me.

Thanks in advance for you kind help.

Regards,
Younid

[primetomas]

Make sure you don't have "Allow Validity Override" set in the certificate profile. Then not worked for me with Validity Offset set to -100y. With "Allow Validity Override" checked, it overrides with todays date, from the CA request.

[younid]

Hi @primetomas,

Thank you very much for you help and very good support.
I tested and it worked fine. I managed to create a RootCA with valid period from 2018 until 9999.

Regards,
Younid