Consider the following scenario. On a computer that is running Microsoft Windows Server 2003 R2 or Microsoft Windows Server 2003 with Service Pack 1 (SP1), you create a certification authority (CA). You then add custom extensions in the CAPolicy.inf file. Then, you renew the root CA certificate by using a new key. In this scenario, the custom extensions do not take effect.

For example, you use the CAPolicy.inf file to suppress the CRL distribution point extension. Then, you renew the CA certificate by using a new key. In this example, the root certificate still has the CDP extension.

Back to the top

To resolve this problem, renew the CA certificate again. This time, use the same key for the new root CA certificate. To do this, run the following commands at the command prompt:

Back to the top

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

Back to the top