PKI How to set manually AIA and CDP file name for a subordinate CA

Hello,

Thank you for posting question on Microsoft Windows Forum.

Based on your query of changing the AIA file name on an intermediate CA. Actually, changing the AIA (Authority Information Access) file name for an intermediate CA isn't as straightforward as modifying the CDP (CRL Distribution Point) file names. The AIA file name is generated automatically based on the CA's configuration. The default naming convention <ServerDNSName>_<CAName><CertificateName>.crt is hardcoded into the CA service for AIA files. Unlike CDP, Microsoft does not expose a direct GUI or simple configuration to fully customize the AIA filename.

You can consider the following suggestions as workarounds.

1. Copy/duplicate the file under your preferred name
   • Keep the default publication so AD CS manages it normally.
   • After service start or renewal, copy the latest CA cert to your desired name inside the same CertEnroll directory.
   • Point your HTTP AIA URL to the stable “friendly” filename.
2. Create an IIS rewrite/alias
   • Leave the physical file with the default name.
   • Use IIS URL Rewrite to serve “MySubCa.crt” while mapping it internally to the actual file. This avoids file copies and lets you keep a stable public URL.
3. Publish to AD (LDAP AIA) and keep HTTP minimal
   • Many domain‑joined clients will fetch the issuing CA cert from LDAP automatically.
   • Keep the HTTP AIA with the default filename and rely on LDAP for resilience. This sidesteps the filename requirement unless a device explicitly needs the HTTP path and a fixed name.

You can refer to the following article for more information.

https://learn.microsoft.com/en-us/windows-server/networking/core-network-guide/cncg/server-certs/configure-the-cdp-and-aia-extensions-on-ca1

Hope the above information is helpful!