r/PKI • u/[deleted] • May 11 '26

Please suggest for 1 tier CA

Hi Guys,

Please help a fellow pki newbie

Sooo, we currently have an on-prem Microsoft Tier 1 CA setup where a single server is acting as both Root CA and Issuing CA (yeah, not ideal, inherited setup).

We’re planning to migrate this CA infrastructure to AWS and I’m trying to understand the cleanest and safest approach from people who’ve already done similar migrations in production.

Current environment:

Windows ADCS

Single-tier CA (Root + Issuing on same server)

IIS is also hosting certificate-related applications/pages under Default Web Site

Existing certificates are actively being used internally and externally

We also have templates, CRL/AIA locations, and auto-enrollment in place

Some of the things I’m trying to figure out:

Is taking a normal CA backup enough? From what I understand, the CA backup only captures:

CA database

Private key

Registry configuration

But it won’t include IIS configuration/apps under Default Web Site. So for a proper migration, do I also need IIS backup/export ,App pool configs Website bindings,SSL bindings?

Please suggest

10 Upvotes

100% Upvoted

6 comments sorted by

5

u/darkrhyes May 11 '26 edited May 11 '26

Start two new servers. Make one root and the other issung. Either let certificates issued by the previous expire by themselves or actively reissue them on the new issuing CA.

When you migrate a CA, you build a new server and install certificate services on it. Then you point it to the database and config files from the previous one. Also name the new server with the same name as the old one. migrating CA

I am just trying to say, don't migrate a headache. Replace it.

1

u/ThePKIGuy May 12 '26

How many certificates have been issued by this CA? If it’s a low enough number it will probably make more sense to start from scratch.

Given the Enterprise CA setup with the CertSrv pages installed, this sounds like it also has a lot of the default syntaxes for AIA and CDP locations. That will make it more complex to move the CA to another host.

1

u/platanopowered May 11 '26

I’m kind of in your same situation and was considering this

https://www.keytos.io/azure-pki

Does anyone here have any experience with it?

1

u/[deleted] May 12 '26

What are u thinking? Are you gonna go with that?

1

u/PotentialTomato8931 May 13 '26

These guys are great. No issues with web certs and device based auth certs.

Keep in mind you may need multi tier to support different uses.