Moving Certificate Services To Another Server

KB ID 0001473

Problem

If you are retiring a CA Server, or there’s a problem with the server and you want to move Microsoft Certificate Services to another server, the procedure is pretty straight forward.

BE AWARE: We are moving the CA Server Name , NOT the Server Name (FQDN), the two things are NOT the same, (you might have called them the same thing!) But a Certificate Authority has a name of its own, and that’s what we are going to move.

So the new server doesn’t have to have the same name? No, it can do if you really want, but that’s an added layer of complication I can’t see the point of?

In the video below, I’m migrating from Server 2008 R2 to Server 2019, and I’m also moving CRLs and OSCP responders. In the screenshots below I’m moving from Server 2016 to Server 2016, but the process is pretty much identical all the way back to Server 2003.

Can I migrate from Server 2008 (NON R2) to 2016 (or newer): Yes, but not directly, you need to upgrade to Server 2012 R2 first. If you don’t, the database wont mount and you will get this error.

Solution

On the ‘Source‘ server, open the Certificate Services management console > Right click the CA NAME > All Tasks > Back up CA.

Transfer CA to Another Server

The backup wizard will open, Next > Tick BOTH options > Select a Backup Location > Next > Set a password (you will need this to set the new CA up!) > Next > Finish.

Backup CA Settings Wizard

Now we need to take a backup of the Registry key that holds the information for this CA server. Run ‘regedit’ > Navigate to;

HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Services > CertSvc > Configuration > {CA-NAME}

Export a copy of this key, (save it in the same folder that you backed up to earlier).

Export CA Settings Windows 2016

Now we need to uninstall CA Services from this server. Server Manager > Manage > Remove Roles and Services > Next.

Remove Roles Server 2016

REMOVE all the CA role services first! > Complete the Wizard, then launch the wizard again and select ‘Active Directory Certificate Services’ > At the pop-up select ‘Remove Features’ > Next.

Remove CA Roles Windows 2016

Next > Next > Next > Close.

Transfer Certificate Services to Server 2016

Setup Certificate Services on the Target/New Server

Server Manager > Add Roles and Features > Next.

Install Role or Feature 2016

Next > Select ‘Active Directory Certificate Services’ > Add Features > Next.

Install CA Role 2016

For now let’s just stick with the Certification Authority > Add the other role services later* > Next.

*Note: I’ve written about all these role services before, just use the search function, (above), if you are unsure what they all do.

Install Certificate Services Role 2016

Next > Close.

Setup Certificate Services

Warning > Configure Active Directory Certificate Services > Next.

Restore Certificate Services

Next > Enterprise CA (Unless it’s an offline non domain joined CA) > Root CA (unless it’s a subordinate CA!) > Next.

Configure 2016 Certificate Services

> Select ‘Use existing private key‘ > Select ‘Select a Certificate and use its associated private key‘ > Next > Import > Browse > In your backup folder locate the certificate (it will have a .p7b extension.) > Enter the password > OK > Select the Cert > Next.

Restore Certificate Services Differnet Server

Next > Next > Configure >  Close.

Migrate Certificate Services Differnet Server

Stop Certificate Services;

net stop certsvc

Stop Certificate Services

If your new server has a different hostname/FQDN open the registry file you exported above with Notepad, locate and change the CAServerName entry to the name of the NEW server.

Change CA Server Name

Right click the registry backup > Merge > Yes > OK.

Import CA Settings to Registry

Launch the Certificate Services management console > Right Click the CA NAME > All Tasks > Restore CA.

Restore Windows CA

The restore wizard will start > Next > Browse to the folder with your backup in > Next > Enter the password you used (above) > Next > Finish.

2016 Restore Windows CA Wizard

You will be prompted to start the Certificate Services service > Yes.

Restart Restored Windows CA

What About Certificate Templates? Do I need to Move Them?

No! Certificate templates are actually stored in Active Directory, NOT in/on the actual Certificate Services server, (that’s why sometimes they take a while to appear after you create them!) You can see them here;

Certificate Templates in Active Directory

Related Articles, References, Credits, or External Links

NA

Author: PeteLong

Share This Post On

133 Comments

  1. Thank you for submitting the new hostname CA server Fix.

    Post a Reply
  2. Nice and clear walkthrough

    I used this to perform a move for the CA service on a pair of 2012 R2 servers.

    No issues were experienced beyond ensuring *NOT* to select the “database” sub-directory when performing the final restore, use the parent directory.

    Thanks for taking the time to write and present this so well.

    Stu

    Post a Reply
    • No problem Stu, thanks for the feedback.

      Post a Reply
  3. Thanks for the nice and concise write-up. I’ll be using it to migrate a 2008R2 CA to a 2016 server. Quick question, do I need to back up and restore the cert templates too?

    -George

    Post a Reply
  4. Any downtime for this? Considering doing this during the day.

    Post a Reply
    • Only for the PKI service while you swap over 🙂 Users probably won’t even notice.

      Post a Reply
  5. Worked on 2019 as well

    Post a Reply
  6. Can you install the new CA role but not restore the services prior to doing the swap? Would speed up the process not fully removing old and then installing new etc.

    Post a Reply
    • It is not possible because:
      It is important to remove the CA role service from the source server after completing backup procedures and before installing the CA role service on the destination server. Enterprise CAs and standalone CAs that are domain members store in Active Directory Domain Services (AD DS) configuration data that is associated with the common name of the CA. Removing the
      CA role service also removes the CA’s configuration data from AD DS. Because the source CA and destination CA share the same common name, removing the CA role service from the source server after installing the CA role service on the destination server removes configuration data that is required by destination CA and interferes with its operation. The CA database, private key, and certificate are not removed from the source server by removing the CA role service. Therefore, reinstalling the CA role service on the source server
      restores the source CA if migration fails and performing a rollback is required. See Restoring AD CS to the source server in the event of migration failure.

      Post a Reply
      • I’ve seen a couple different takes on this…

        One states that the removal of the CA roles on the one server is absolutely necessary prior to adding and configuring them on the replacement server.

        Another states that one can simply force the one server offline (e.g. disable the NIC) so it’s not available when the replacement server comes online.

        You clearly take the first position, and it makes sense. It’s a bit nerve-wracking, even with the rollback options, but it makes sense.

        Question: If the replacement server has a different hostname, and the certificates show the original server’s hostname as part of their CRL Distribution Point, will the steps in this article account for those, or will I need to take additional steps such as creating a CAPolicy.inf file?

        Alternatively, I’ve considered just making a separate DNS entry for the old hostname pointing at the new IP.

        Post a Reply
  7. Excellent ! I would have never figured that out, especially the registry modification.
    Move a 2012R2 over to 2019 Server not issues.

    Post a Reply
  8. Some articles say to change the name of the new CA Server to match the old CA server after you decommission the old CA server… so this is NOT necessary right? The only thing is the new server name will not match the CA name right? Oh and you would not need to modify CAServername registry entry….

    Post a Reply
    • I don’t (usually) and I’ve never had a problem?

      P

      Post a Reply
    • You can’t. The add roles/features wizard specifically states that once you add the CA role, you can’t change the hostname and or domain afterwards.

      Post a Reply
  9. Thanks for the article, good work!

    What about the AIA and CDP distribution points, and the CRL urls? Do you need to do anything to those to change them etc?

    Post a Reply
    • That is a great point! If you are retaining the server name, things like AIA will probably be the same, but CRL and OSCP may well need to man manually recreated (with the same paths, or changed to the new server name).

      Post a Reply
  10. Thanks the article is very straight forward. My question as I prepare to move my CA to a new server is how do the clients find the CA?

    If the CA was one name or on one server how do they find it when I move to a new server with a different name?

    Thanks,
    Dave

    Post a Reply
    • They will find it in Active Directory 🙂

      Post a Reply
      • So it will replicate the changes with AD?

        I only ask because its a huge move considering if things don’t work my users wont be able to login.

        And thanks so much for taking the time to answer me.

        Post a Reply
        • Even if you are doing 801.x authentication the root CA cert will be the same, all previously issued certs will remain trusted. 🙂

          Post a Reply
  11. Awesome, thank you so much

    Post a Reply
  12. Is it safe to assume same steps would work migrating from 2008 R2 to 2016 Server?
    I already have prepped 2016 server that is domain joined.
    Would you also recommend making it a domain controller since my 2008 CA is also a domain controller
    with schema master role assigned? I was planning on moving that role ahead of time, but should I still make it a domain controller ?
    Thank You

    Post a Reply
    • Yes in fact I’ve done it in anger 🙂

      Post a Reply
      • PeteLong when you say Yes to Luke, which question are you saying Yes to? I was thinking of taking this opportunity to move my CA off of my 2012 DC and moving it to a member server. Everything I see says to keep it off of a CA so that is why I’m looking at it.

        I was thinking I could bring up a new DC2019 and then demote the DC2012 (that has the CA on it). Now it’s just a member server. I could then install a new MemberServer 2019 and move the CA from the 2012 server to it.

        What are your thoughts on this process?

        Post a Reply
        • I mean the upgrade/migration process will work.
          I don’t recommend making it a domain controller, (unless you have no choice).
          Treat migrating domain controllers and migrating CA’s as a separate thing!

          Post a Reply
  13. I have something similar to this but I wanted to see if someone can comment on this: i have a CA server on an old 2008 R2 enterprise domain controller which I want to retire I also have two additional one is 2012 R2 and the other one is a 2016. all roles are managed by the 2012 DC
    is it advisable to just install CA services on both 2012 and 2106 DCs and retire the 2008 DC or do i need to migrate the DB from the 2008 into one of the other two domain controllers?

    Any feedback would be greatly appreciated. thanks, Wil

    Post a Reply
    • Migrate the Root CA, then simply remove the CA roles from the SubCA servers and create some new ones, take a backup of them before you kill them in case you need to retain the intermediate CA certificates for any reason (i.e. 802.1x, or NDES, or appliances you manually put certificates on).

      P

      Post a Reply
  14. What an excellent article. I’ll be using this as a guide to migrate a 2012 R2 CA to 2016 this week.

    One quick (I hope) question: We’ll be changing the hostname and IP address of our CA. Is it strictly necessary to remove the CA roles from the original CA prior to installing those roles on the new CA? Or, can the original CA be shut down pending successful migration?

    Post a Reply
    • Well no it’s not strictly necessary, but the CA can only exist in one place, the sever-name and the CA name are NOT the same, as soon as the CA is imported and online on the new server it CANNOT be online on the old one 🙂

      P

      Post a Reply
      • Perfect. Thanks again! Sounds like the best way to ensure some fallback plan (or management peace-of-mind, anyway) is to disable the NIC on the server hosting the old CA so, even powered on, it can’t talk to others. Out-of-Band-Management is obviously key to being able to do this.

        Then, once we’ve got green light on the new CA on the new server, we can remove the roles from the old server.

        Post a Reply
        • Even easier to disconnect Ethernet cable from old server. 🙂

          Post a Reply
  15. Thank you for a great article. Worked perfect. Just a quick comment, I had CNAME’s for CRL and AIA in my local DNS pointing to the old server hostname. I updated those to the new server hostname.

    Post a Reply
  16. When installing CA on the new server, when I go to configure it, the option for Enterprise CA is grayed out. Do you know why that is?

    Post a Reply
    • Is it already a domain member server?

      Post a Reply
  17. We have root offline CA (Non Domain Joined) and Intermediate CA (Domain Joined) both are on 2008 R2
    can we follow same process to migrate both server?, first migrate Root offline CA to 2019 and then migrate intermediate CA to 2019
    is there anything else required.

    Post a Reply
    • I’ve not done this, but I don’t see why not, as we are moving the CA, not the server. You can Test it in a virtual sandbox, but I can think of any problems.

      Post a Reply
  18. work this on domain controllers servers ?
    i have DC where is running CA and need migrate to new server with new FQN name.. but CA name will be same as old..
    thanks for help 😉

    Post a Reply
    • The fact its a DC does not matter its the “CA name” you are moving 🙂

      Post a Reply
  19. Correct me if I am wrong – it may be a good idea to make a note of and then remove all certificate templates on the old server prior to taking a backup of the existing CA to ensure that no certificates are issued between the time you take the backup on the original server and restore on the new server. The templates could then be re-added after the restore is done.

    Post a Reply
    • Templates don’t live on the CA server, they are stored in AD, that’s why if you have a lot of domain controllers, you need to wait a few minutes before you can issue a ‘new’ template. You are waiting for domain replication to occur.

      Post a Reply
      • Perhaps I was not as clear as I could have been. I was suggesting that you could unpublish the templates to prevent certificates being issued between the moment you take the CA backup and disable/remove Certificate Services on the old server. The chance of this happening is small, but couldn’t it result in an ‘orphan’ certificate being issued?

        Post a Reply
        • The worst that would happen is you would not be able to revoke it.

          Post a Reply
  20. Everything seems to have worked except the registry import, is it a requirement or can we run without it?

    Post a Reply
    • No you definitely need that to work!

      Post a Reply
  21. Great information!

    My team and I are ready to execute this Migration from a 2008 Server to a 2012R2. Our main concerns are:
    1. If the server has a different name, even if we change the name in the registry export to the new name, how does that affect any currently issued certificates with the old name embedded into it?
    2. How do you get all computer objects on the domain to update the certificate once the new cert is up and running?

    I’m a bit novice to Managing a Certificate Store, but the project is mine to undertake and i certainly want to learn, so please Jedi Masters, give this Padawan Guidance! Thanks!

    Post a Reply
    • 1. Man Im sure I’ve mentioned this six thousand and seven times, stop worrying about server names, server names are not important at all, you are moving the CA name. So changing the server names affects nothing.

      2. Assuming your computers are auto-enrolling, (if not then they wont have any certificates?) then they will renew from the CA NAME which they will find in active directory, and which hasn’t changed from the last time they got a certificate, it’s just on a different server 🙂

      Imagine ‘Boots the chemist’ moves from the middle of town, to the out of town shopping centre, your question would read how do we buy paracetamol now Boots has changed its address.

      P

      Post a Reply
      • PeteLong, If the server name is irrelevant, then why is the cert server name embedded in the local workstation and server certificates? See the ProdCert1v server name in the certificate below:

        (ldap:///CN=xxxxxxxxx%20xxxxxxxxxxxx%20Certificate%20Authority,CN=PRODCERT1v,CN=CDP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=xxxxxxxxxxx,DC=com?certificateRevocationList?base?objectClass=cRLDistributionPoint)

        Post a Reply
        • It’s the CRL URL in your reference, the person that originally installed that chose that URL/hostname. If you wish to support existing CRL lookups using this FQDN it either needs to be replicated or redirected from the original server.

          However, within an AD environment LDAP is used first. This is why if your CA services non-domain members, it’s probably best to remove the LDAP location and just use HTTP to speed up resolution.

          Hope this makes sense!

          Post a Reply
  22. To PeteLong…. Thank you!
    Christmas Gift for me to have an easy path!

    Post a Reply
  23. Very Clean walkthrough. Thanks

    Post a Reply
  24. Hi,

    I am in process of upgrading existing CA environment – 2008 -> 2019. Offline Root CA and 3 domain member SUB CA’s. After upgrade I will only need one SUB CA.
    My idea is to migrate the Root CA using backup/restore as described here to a new server with new name (I think straight forward). On the current 3 SUB CA’s I want to disable auto-enrolling – and keep them alive until latest issued certificate have expired. Install a new sub CA with with auto-enrolling enabled?
    Any pitfalls doing it this way?
    Torben

    Post a Reply
    • Not that I can see, as long as they are left up for the same amount of time that the certificates are valid 🙂

      Post a Reply
  25. This worked well for me thank you. On the original CA I had created a “User VPN” template for auto-enrollment. I am not sure if it was necessary, but I did reissue this certificate template on the restored CA. The User VPN template was not listed until I had selected “New -> Certificate Template to Issue”

    Post a Reply
  26. Thanks for the slick write up. I really appreciate this and the other articles you have contributed to the community Pete!

    Sam

    Post a Reply
  27. Pete,
    Great work, great write up.

    Quick question.

    I’m planning on upgrading a rootCA and a SubCA (2008r2 to 2019).
    I follow the steps that you laid out for the root, I understand that.

    What about the sub?
    Do I do the same (ie backup the sub and the sub’s reg then restore to 2019)?
    Or did I see in the comments to just install a brand new sub (even though many certs issue from sub)?

    Thanx!

    Post a Reply
    • Same procedure for the SubCA if you want to migrate it, you can also create a new one just as easy 🙂

      Post a Reply
  28. Great write up Pete!

    Just a quick question, We have our CA on a 2008 DC which we want to decommission and shut down for good. Once we move the Certificate Services over to a new domain member server are we able to then demote the DC and then kill the server for good?

    Just wanted to check demoting and killing the server wouldn’t cause issues with the CA on the new server?

    Post a Reply
    • Yes – providing theres nothing else on it (DHCP, DNS, Terminal Services Licence server etc,)

      Post a Reply
  29. Put me in the same boat as those scrambling to remove 2008R2 servers from their environment. Followed these steps last night. All quiet in the office today. Would add that i was seeing errors in ‘pkiview’ referencing the old CA server, and i needed to publish my revoked certificates and then refresh the pkiview screen and that cleared those.

    im still getting ‘unable to download’ on the delta crl #3 and cdp location #2 where the location is file://NEW_CA_SERVER….. but if i copy the url and browse in explorer its working, so not sure what to do there

    in any case, kudos to PeteLong for actually reading and responding to so many people, after this post has been up all this time. top bloke!

    Post a Reply
  30. I have a Server 2008R2 and CA is running on a DC. I am planning to move CA role for DC to on its own new 2019 Server. Hostname will be different. Do I need to change any registry value if it has a different hostname? or do I need to perform any further steps apart from what is in the article.

    Thanks and very helpful write up.

    Post a Reply
    • Yes you DO need the change the server name in the registry key backup, to the new server name 🙂

      P

      Post a Reply
      • I am having the same idea like Bhav. I have a 2008DC with CA Role installed. I want to take the CA Role out and put it on 2019 Server with different hostname. Could you tell me how to change the server name in the registry backup?

        Post a Reply
        • That information is in the post.

          Post a Reply
  31. Hello pete

    First of all thx for the guide, will help a lot to guys like me that do not usually play with CA’s, are on a small business and have an inherited problem from his predecessor.

    what you would recomend in a case that there is a CA server on a w2008r2 DC with a cert using a deprecated SHA1 hash algorithm?

    first migrate it using your guide to a w2019 and then upgrade the SHA1 cert to a SHA256 or
    First upgrade the SHA1 to SHA256 and then migrate to the new server?

    Just check it with certutil -store my the provider is Microsoft Software Key Storage, so at least i dont have to upgrade from CSP to KSP, which is a little relief.

    Post a Reply
    • Great Question!
      You can do it either way, I personally would sort the SHA1 problem out first, but theres no reason at all not to do it the way round you suggest.

      And thanks for the feedback!

      Post a Reply
  32. Thanks for the great article. My brain is teflon when it comes to retaining CA knowledge. Definitely one of my weaker skillsets.

    I’m not sure this was made clear in the comments posted, so I’ll spell it out just in case.

    Firstly, one of my pet peeves is when people don’t quote R2 when talking about that version of Server 2008. Where I work we have a Windows Server 2008 migration project when the vast majority (if not all) are 2008r2 – drives me crazy.

    Anyway, since I don’t want to assume all comment posters are good techies and referencing their OSes properly in their questions, I want to clarify:

    If you have Windows Server 2008 CAs (not R2) and you want to migrate to 2016 or 2019, you MUST first do a migration to 2012r2

    If you have 2008r2 CAs, you can go straight to 2016 or 2019.

    Post a Reply
    • I’ve updated this post (above) and linked to what will happen if you attempt to upgrade 2008 (non R2) to 2016/2019.

      Pete

      Post a Reply
  33. Hello.

    Can we use this procedure for a subordinate CA?
    Should we start updating root ca first or it does not matter?

    Post a Reply
    • Hi Victor, I would always do the root first, but that’s just my OCD. I cant really think of a good reason not to do it that way, as its a hierarchical system.

      Post a Reply
  34. Pete,

    This was an absolutely great article and made going from a Server 2012R2 DC CA to a 2019 one easy-peasy-lemon-squeezy.

    Thank you for such a well-written article.

    Post a Reply
    • Thanks for the feedback Doug 🙂

      P

      Post a Reply
  35. Awesome post – thanks for that…Just one stupid question (since I followed your post exactly), for peace of mind, what is the best process for verifying the migration was successful?

    It’s noon on a Sunday, all my CA skillset is horrible…Thanks …/Mike

    Post a Reply
    • Request/Issue a certificate is the simplest way to test the system. 🙂

      Post a Reply
  36. I’m about to do this migration but i do have a question. Do i need to export the Certificate Templates from the 2008r2 server and import them into the new 2016 server? I cant find anywhere online if that is needed to be done

    Post a Reply
    • I think I mentioned this above, templates are stored in Active Directory NOT on the CA

      P

      Post a Reply
  37. Thanks you for this article. I am retiring a site hosting a virtual subordinate CA server. I am wondering if cloning the CA server, restoring it to the new VM infrastructure and re-IPing will cause an issue? Or, build a new CA in the new site and following your above process. Thx so much.

    Post a Reply
    • As long as you don’t change the server name, and remember to add the new subnet to ‘AD sites and services’ you should be ok 🙂

      Post a Reply
  38. Hi Pete, this is a great article. Thank u for replying to all guys. I have a question ref migration from CA 2008 r2 to 2016. After we remove the CA role from the 2008 r2 dc and install on 2016. We want to keep the old server as it is a DC for maybe a few weeks after the migration. Is it necessary to power off the server after CA migration or can we simply keep it running without the CA role and act as a backup DC? Appreciated

    Post a Reply
    • No the old server can remain, that’s fine as long as i’ts got a different name of course 🙂

      Post a Reply
  39. Hi

    Thx very much for your wonderful article.
    When moving from 2008r2 to 2012r2/2016/2019 AND with different hostname is it required to reissue the template certificate ?
    I see as per official microsoft doc that is a require step BUT You don’t mention it on your article

    Post a Reply
    • NO templates are stored in AD! (I’ve updated the article to show you where).
      P

      Post a Reply
  40. Like many I have a PDC that is AD CS. I would like it to remain the AD CS and remove AD DS. Is there any reason you can think of that I wouldn’t be able to transfer the FSMO, demote and remove ADDS and leave the CA installed?

    Post a Reply
    • None at all, what you propose wont be a problem 🙂

      Post a Reply
    • I don’t think you can Demote a DC while its a certificate server

      Post a Reply
      • You are correct attempting to demote a DC running CS will result in it stoping, and asking you to remove Certificate Services first.

        P

        Post a Reply
        • Hi, is it supposed that is possibile to demote the OLD DC holding the CS AFTER the migration on the new server (with different hostnames) . In other words: is it safe to remove the cs service from the old server once the new server with the new cs is up and running in production ? Thx

          Post a Reply
          • You cant demote a DC if its a CS Server it will not let you. Migrate CS, when that’s done demote the server.

  41. Hey Pete,

    First off, a big thanks the excellent guide.

    I was just wondering if you also know if I could change the displayed name in the CA management console, just so no confusion arises amongst my coworkers for example.

    Changing the ‘Active’ and ‘Common Name’ REG_SZ keys in the Configuration registry settings as well as the name of the registry folder caused ‘file not found’ errors when trying to restart certsrv.

    Would be awesome if you know a trick for this!

    Post a Reply
    • This is why I name my CA’s differently to the Hostname(s) they are residing on 🙂 ASFAIK (and I’m happy for someone to pitch in and say I’m wrong,) you can’t change a ‘CA Name’ You would need to remove it an create a new CA, which has many other inherent pitfalls in a working domain.

      Post a Reply
  42. Thanks for the excellent article and video Pete. I will use it for our next migration

    Post a Reply
  43. Thank you for the article, great help, i did notice on the server that you were migrating to that Active Directory Services was also selected in the screenshot, is this required? I am migrating the CA from an existing Domain Controller which I am also demoting, i believe that this needs to be done prior to that. With the new server, i just want to confirm if AD services are also required?

    Post a Reply
    • No it’s not, that was done on the test bench and it saved me building two servers.

      Post a Reply
  44. Hi Pete
    As suggested just trying to the backup of certificate server on windows 2008R2 ent. But wizard completes with an error that some of the CA server certs private key is unexportable. I even checked the certs in certificate MMC for computer account and cant even export them from there.

    Error is like windows cannot backup one or more private key because CSP doesnt support key export.

    would you know something about this.

    thx
    shishir

    Post a Reply
  45. Thank you Pete for your detailed articles and they have been a life savor!

    I have recently moved a Windows 2008 R2 CA to a new Server 2019 OS with a new host name. The move went well with one major issue. I am unable to create a SHA-2 CA cert and on SHA-1. This is causing all of our internal sites and other issued certs to issue Weak Cipher warnings and other issues.

    I noticed in the registry the item “CAServerName” has the imported old 2008 R2 OS host name since that was exported and imported into the new 2019 CA. Is it safe to stop the certsvc, update the Reg key “CAServerName” and start the service if this is already issuing certs?

    The CSP Reg key already has a CNGHashAlgorithm of SHA256 and Provider of “Microsoft Strong Cryptographic Provider” data set.

    Post a Reply
    • I’ve covered upgrading CA’s to SHA2/256 elsewhere on the site?

      Post a Reply
      • Hi Pete,

        Is it possible to migrate a subordinate CA before RootCA? I am planning a migration for CA roles from 2003R2 to 2012R2 and wondering if I Can migrate the Subordinate CA server before the RootCA server?

        Post a Reply
        • Technically yes, as long at its SubCA certificate stays in date through the procedure, but I’ve never done it that way.

          Post a Reply
  46. Excellent post and I really admire the way you addressed everyone’s questions:
    I have a question…
    For future management and ease of upgrades, we wanted to separate CA from a 2016 serverA DC, which is also has other roles like (DHCP and DNS), to a newly built 2016 ServerB,
    1. Is it possible to keep both ServerA and ServerB After migration following your post?
    2. If it is a must to rename the source server ServerA, what would be your suggestion/recommendations? s there a clean way to do it?

    Post a Reply
    • 1: Yes
      2: Assuming it’s not doing something important (like Exchange or SQL for example,) then simply rename the server, (and then reboot it, to reregister its DNS entries). Then check your DNS servers do not have any old ‘static entries pointing to the ‘old’ name.

      Post a Reply
  47. Man I am dying here…
    Cannot renew NPS Cert. Because the CA Certificate templates was showing the server I was going to move it to I thought that was probably the problem. So I went ahead and moved it to that machine even though it isn’t where I would like it to reside. It is now on server2 and the templates reflect server2 but I still get the same error when NPS trys to renew. “The requested template is not supported by this CA”. A valid certification authority (CA) configured to issue certificates based on this template cannot be located, or the CA does not support this operation, or the CA is not trusted.
    Man I could use some help. There is so little info on the internet.

    Post a Reply
  48. Figured it out. For some reason the Backup and restore process did not restore all of the Certificates to Issue area of the CA, and since I originally set it up 7 years ago an essential piece of basic CA setup was forgotten. Although the template for NPS radius was in manage certificates, it was not in the main window when clicking on the manage certificates folder for certificates to issue. Now in my defense, this was available in the certificates to issue area of the original CA. Why it didn’t transfer with the backup/restore process i do not know.

    Post a Reply
  49. When moving CA back to 2012 Server that is now NOT a Domain Controller, The ability for the CA to issue an NPS RADIUS Certificate goes away. When you manage certificates you can see the template, but you cannot add it to the Templates this CA can serve. It would appear for a CA to issue NPS Radius Authentication Certificates, the CA must reside on a DC.

    Post a Reply
  50. Hi Pete

    Hope you’re well.

    Can i use this guide to migrate from a 2012 R2 to 2019 standard? The 2012 R2 is also a DC plus DHCP and obviously DNS so i’ll need to migrate all roles to the new 2019 Server

    Thanks

    Post a Reply
    • Yes treat each migration separately, and don’t move the DC role until after certificate services has moved, I’ve covered DHCP migrations, (use the search above) and DNS will move with the DC role.

      Post a Reply
  51. Hi Pete, great article and youtube video, thank you! I think you might laugh and cringe at the same time when you read this question. My boss threw me into the middle of their CA migration project and wanted me to finish it up, problem is they just stood up a brand new Root CA server while leaving the old Root CA still up and running (we dont have any subordinate CAs). They began creating new certificates for just the web servers we host on the new CA. After reading your article and many others I told them to pump the breaks!

    My question is, on a scale from 1 – 10 how screwed are we? What would happen if we continued with the new CA and just turned off the old one? Would all the servers and client PCs auto enroll with the new CA? I just want to understand the implications of the direction we took. Thank you in advance.

    Post a Reply
    • 🙂 Theres no reason I can think of that you are ‘screwed’, essentially as long as your clients trust BOTH old and new root CA servers and the CRLS stay online then nothing will break?

      Post a Reply
      • GREAT news to hear! As of right now all clients trust both CAs. So if we turn off the old CA and all the servers check in with GP, will they all auto-enroll with a new certificate from the new CA? No moving of the old database and reg key required?

        Post a Reply
        • Yes, just make sure if theres a CRL stamped on certificates issued by the OLD CA Server, you will need to maintain that until all the certs issued from that CA server have expired, or are no longer needed.

          Post a Reply
  52. Thanks for sharing the steps to move CA, I need to move the CA root server from 2003 to 2019 OS and we have a CA subordinate which is on Active directory server, can follow the same steps for 2003?

    Could you help me to upgrade the hash algorithm as well from SHA1 to SHA2.

    Post a Reply
    • Wow 2003? Back then I wasn’t that deep into this stuff, I’d need to build it all in VMware and test it, Sorry I just dont have the time to work that out for you.

      Post a Reply
  53. Hi there,

    Many thanks for sharing your knowledge.

    I am in a process of migrating our cert role from Server 2008 32bit, upgrade to 2008R2, then migrate the role to server 2016, but it seems that the architecture is not compatible.

    Do you happen to know a way i could follow for this migration, please?

    Regards
    Tedy

    Post a Reply
    • Ah OK – If you are 2008 x32 you need to migrate to 2008 x64, then migrate to 2008R2 (Google “Active Directory Certificate Services Migration Guide”)

      Post a Reply
  54. Thank you for the guide, like many others Im on the same boat working on upgrading RootCA with two SubCA and another RootCA their all in 2008 R2 and your guide is a great help in this endeavor. I have been reading a lot of guides and really I would like to side with caution and try upgrading them in stages from 2008 R2 to 2012 R2 then 2019 and instead of migrating/moving them to a new server or upgrading them one time to 2019. I dont think its an issue whichever route we take in place upgrade vs backup and restore to a new server but wanted to get your thoughts on it.

    Also our DC is currently running on 2012 R2 would it be an issue if CAs are ahead?

    Post a Reply
    • Hi Jonathan,
      Indeed, you are only as good as you last backup! Your DC wont be a problem, and wont trip you up.
      If you super cautious P2V (or V2V) the boxes and, sandbox the upgrade to test it first.

      As you are at 2008R2 then theres no ‘gotchas’ as you are running on a newer DB, and wont be x32 bit.
      Good Luck
      P

      Post a Reply
  55. Successfully migrated ADCS, CA and CAWE from 2012 (DC) to 2019.

    Thank you very much

    Post a Reply
  56. First of all, thank you for the article, very useful.

    I have a different requirement, however: the environment I manage has a root CA (not-domain joined server) and a dependent subordinate CA, not autoenrolling. I need to get rid of both, as we have a new enterprise-wide offline root CA and in this particular environment I want to replace the existing subordinate CA with another having different root CA, different name (and different server name). The number of certificates issued by the old sub CA is quite low, indeed all of them need to be gradually ceased as well as the hosts requesting them (we are in a migration phase).

    Can the new sub CA, depending on a different root CA (a new PKI, indeed), coexist with the dying PKI until all the old stuff is made obsolete? Or would the AD get messed by that?

    Thank you very much.

    Post a Reply
    • Yes of course, you can run the new alongside the old until such time as all certificates have expired to been revoked.

      Post a Reply
  57. Thank you very much for this Pete,

    I re-read the article and comments here and had most of my questions answered. I do have a question however regarding moving the CA off of a domain controller that we plan on keeping around. Is it possible to keep the domain controller with the same name moving forward after migrating the CA services off of it over to its own member server?

    Thanks again.

    Post a Reply
  58. Hi Pete,

    We’re planning to migrate our CA from 2008 R2 Ent server to 2019 DC. Just a couple of points, as I haven’t done so in a relatively large/complex environment.
    We also have NDESinstalled. Also SCEP service for Macs. Are there any consideration to be taken around this?
    Also, what would be the rollback scenario of this (backup/restore to new server) scenario if things do not go at planned?
    Thanks for your advise in advance.

    Post a Reply
    • Awesome question – NDES can be a pain, especially if you are using it for anything Cisco related? If you are only using it for macOS then just check that it will support the cyphers in the new environment, macOS can be a bit picky (or more secure depending on your view). Id p2V the DC/CA Servers and sandbox them and give it a thorough testing before going live.
      Good Luck

      Post a Reply

Leave a Reply to ME Newman Cancel reply

Your email address will not be published. Required fields are marked *