7. Migrate to the Federal Common Policy CA G2

We're calling for all solutions! If you'd like to share your agency's playbook on how to distrust a CA certificate, create an issue on GitHub or email us at fpki@gsa.gov.

For the purpose of these steps, we refer to the existing Federal Common Policy CA (FCPCA) as FCPCA G1.

To migrate from the existing FCPCA G1 to the FCPCA G2 as your agency’s federal trust anchor, you’ll need to:

disable enterprise distribution of the FCPCA G1 as a trusted root CA certificate, and
distrust the FCPCA G1.

Heads up! Test the following steps in a controlled environment before you deploy them across your enterprise. If you do not successfully distribute the FCPCA G2 certificate before you begin these steps, you may cause a denial-of-service, impacting smart card logon for your applications and systems.

FCPCA G1 certificate details

FCPCA G1	Certificate Details
Federal Common Policy CA (sometimes shown as U.S. Government Common Policy)	http://http.fpki.gov/fcpca/fcpca.crt
Distinguished Name	cn=Federal Common Policy CA, ou=FPKI, o=U.S. Government, c=US
Serial Number	0130
SHA-1 Thumbprint	90 5f 94 2f d9 f2 8f 67 9b 37 81 80 fd 4f 84 63 47 f6 45 c1
SHA-256 Thumbprint	89 4e bc 0b 23 da 2a 50 c0 18 6b 7f 8f 25 ef 1f 6b 29 35 af 32 a9 45 84 ef 80 aa f8 77 a3 a0 6e

Disable Distribution of the FCPCA G1

Reference the distribution mechanisms here to review the ways the FCPCA certificate could be distributed across your enterprise. Disable all existing distribution mechanisms. Sample procedures to disable the distribution of the FCPCA G1 are listed below using:

Microsoft Certutil
Microsoft Group Policy Object (GPO)
Apple configuration profile (macOS or iOS)

If the FCPCA Was Distributed Using Microsoft Certutil

You must have enterprise administrator privileges for the domain to perform these steps. You must run these commands from an agency domain controller.

Navigate to Server Manager.
Select Tools.
In the drop-down list, select ADSI Edit.
In the top navication, select Action > Connect to .
In the Select a well known Naming Context drop-down list, select Configuration, and click OK.
Browse to the CN=AIA directory (within “CN=Public Key Services, CN=Services”), right-click the entry for the FCPCA, and select Delete.
Browse to the CN=Certification Authorities directory (within “CN=Public Key Services, CN=Services”), right-click the entry for the FCPCA and select Delete.

If the FCPCA Was Distributed Using a Microsoft GPO

You must have enterprise administrator privileges for the domain to perform these steps. You must run these commands from an agency domain controller.

Navigate to Server Manager.
Select Tools.
Select Group Policy Management from the drop-down list.
Expand the Group Policy Objects directory.
Right-click the GPO distributing the FCPCA and select Delete.

If the FCPCA Was Distributed Using an Apple Configuration Profile

Identify how the profile is being distributed across the enterprise (e.g., over-the-air profile delivery or from an MDM server)
Use local knowledge to disable the distribution. If you are having trouble with a specific product, email us at fpkirootupdate@gsa.gov.

Distrust the FCPCA G1

Use one of the methods below to distrust the FCPCA G1.

Use Microsoft Group Policy Object (GPO)
Use macOS Terminal
Use Linux Command Line

Use Microsoft Group Policy Object

You must have enterprise administrator privileges for the domain to perform these steps. You must run these commands from an agency domain controller.

Navigate to Server Manager.
Select Tools.
Select Group Policy Management from the drop-down list.
Right-click your desired domain(s), and select Create a GPO in this domain, and Link it here.
Enter a GPO Name and click OK.
Right-click the newly created Group Policy Object (GPO) and click Edit.
Navigate to Policies > Windows Settings > Security Settings > Public Key Policies.
Right-click Untrusted Certificates, and select Import. The Certificate Import Wizard will open.
Browse to and select your copy of FCPCA G1.
Verify that the target Certificate Store presents Untrusted Certificates, and select Next.
Select Finish to complete the import.

A success message appears.
Close the Group Policy Management window.
Wait for clients to consume the new policy.
(Optional) To force client consumption, click Start, type cmd, press Enter, and run the following command:
```
       gpupdate /force
```

Note: The following .gif shows you how to distrust the FCPCA G1 on Microsoft Server 2016.

Use macOS Terminal

macOS handles certificate distrust differently than Windows does. The steps below distrust the FCPCA G1 certificate by deleting it from the System and Login Keychains. The absence of the FCPCA G1 certificate from the Keychains results in the certificate not being trusted by the workstation. Only system administrators should follow these steps.

Note: Many Mobile Device Management (MDM) platforms allow administrators to push the command below across an enterprise rather than running it on individual workstations. Use automation wherever possible.

Click the Spotlight icon and search for Terminal.
Double-click the Terminal icon (black monitor icon with white “>_”) to open a window.

Run the following command:

 $ sudo security delete-certificate -c "Federal Common Policy CA" /Library/Keychains/System.keychain && sudo security delete-certificate -c "Federal Common Policy CA" login.keychain

Note: This video shows you how to remove the FCPCA G1 certificate using the command line.

Use Linux Command Line

Debian-Based Kernels

Launch the command line.

Change directory with the following command:

     cd /usr/local/share/ca-certificates/

Remove your copy of the Federal Common Policy CA certificate with the following commands (assumes name of certificate file is known):
```
     sudo rm fcpca.crt
```
Update Trusted Certificates with the following command:
```
     sudo update-ca-certificates
```
Run the following command to verify the Federal Common Policy CA no longer has an entry in the system’s trust list:
```
    trust list | grep "Federal Common Policy CA"
```

Red Hat Enterprise Linux, CentOS, and other Non-Debian-Based Kernels

Launch the command line.

Change directory with the following command:

     cd /etc/pki/ca-trust/source/anchors/

Remove your copy of the Federal Common Policy CA certificate with the following commands (assumes name of certificate file is known):
```
     sudo rm fcpca.crt
```
Update Trusted Certificates with the following command:
```
     sudo /bin/update-ca-trust extract
```
Run the following command to verify the Federal Common Policy CA no longer has an entry in the system’s trust list:
```
     trust list | grep "Federal Common Policy CA"
```

Finally, verify migration to the FCPCA G2.