What impact does the expiration of one of the certification authority certificates have on the certification authority?
Certification authority certificates have a defined start and end date, so it is inevitable during the lifecycle of a certification authority that certification authority certificates will expire.
The following describes the impact of an expiring certification authority certificate on the certification authority.
Basics
Do you know TameMyCerts? TameMyCerts is an add-on for the Microsoft certification authority (Active Directory Certificate Services). It extends the function of the certification authority and enables the application of rule sets to realize the secure automation of certificate issuance. TameMyCerts is unique in the Microsoft ecosystem, has already proven itself in countless companies around the world and is available under a free license. It can be downloaded via GitHub and used free of charge. Professional maintenance is also offered.
Regardless of whether it is the current or one of the previous certification authority certificates, the certification authority service will start as usual and certificate revocation lists can also be issued.
The certification authority will log event no. 58 .
A certificate in the chain for CA certificate 2 for ADCS Labor Issuing CA 3 has expired. A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file. 0x800b0101 (-2146762495 CERT_E_EXPIRED). 
When the current certification authority certificate expires...
Of course, if it is the current certification authority certificate, no more certificates can be requested from the certification authority.
Enrollees will not be able to create a certificate request at all or cannot send it to the certification authority.
Certificate requests that continue to be submitted will be rejected, and the certification authority will log event no. 22 with error code 0x800b0101 (-2146762495 CERT_E_EXPIRED).
As the certification authority expiration date approaches, there will be a spike in certificate requests (if there are still certificate templates published for issuance) as automatic certificate renewals are made when 80% of certificate validity is exceeded. This window will get shorter and shorter as the expiration date approaches (see the article "Planning of certificate validity and renewal period of end entity certificates with autoenrollment ").
Related links:
- Certificate request fails with error message "0x800b0101 (-2146762495 CERT_E_EXPIRED)"
- What impact does the revocation of a certification authority certificate have on the certification authority?
- What impact does importing a root certificate into the "Untrusted Certificates" store have on the certification authority?
- What impact does the expiry of the CRL of one of the higher-level certification authorities have on the certification authority?
- What impact does a non-functioning CRL of a certification authority certificate have on the certification authority?
- What impact does the removal of the trust status of a root certification authority certificate have on the certification authority?
- Planning of certificate validity and renewal period of end entity certificates with autoenrollment