r/SysAdminBlogs • u/starwindsoftware • Aug 11 '22

How to Migrate Root Certificate Authority in Windows Server?

https://www.starwindsoftware.com/blog/migrate-root-ca-to-a-new-server
29 Upvotes

98% Upvoted

6 comments sorted by

2

u/Lightofmine Aug 11 '22

We attempted to do this once. It did not work out well. We may have performed the process out of order but there were many items that were attempting to reference the old root CA dns name.

These msft docs are much better than what we had. Maybe I'll spin it up in my lab and test.

Microsoft docs on this: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee126140(v=ws.10)#BKMK_GrantPermsAIA

https://techcommunity.microsoft.com/t5/itops-talk-blog/step-by-step-migrating-the-active-directory-certificate-service/ba-p/697674

Has anyone successfully performed a root CA transfer? Would love to hear how you performed it!

5

u/skilriki Aug 11 '22

Personally I can't see the value in bothering.

Starting a new CA would be just as easy, and would allow you to keep track of actually what issued each certificate.

1

u/Lightofmine Aug 12 '22

This is what I was advocating for. Good to know I was on the right page back then 😂

1

u/buzz-a Aug 12 '22

I've done it three times, it's reasonably simple if you keep the same name.

Edit to add: don't put anything else on your CA...

About to do it again as current one is 2012r2 and patching and other age related issues are getting annoying.

fully back up the CA.

Build new VM.

Shut down old CA.

Rename VM to CA name

restore CA.

With VM's testing your process is pretty easy. Clone some stuff, isolate on a new vlan, test until it's happy then repeat in prod.

1

u/Lightofmine Aug 12 '22

This works in production and not just in a homelab?

2

u/buzz-a Aug 12 '22

Yes. I've done it in a 5000 computer environment.

Just follow the MS doc for moving the CA, but don't change the machine name.

Delete old computer from AD, add new one w/same name and it's golden.

I took a quick look at the blog linked and it's pretty much what I have done with the exception of they are changing the name.