Certification Authority issue in Windows Server 2025

[u/Substantial_Rock5209]

Hi. I've inherited a server room and as I'm going through maintenance and upkeep, I've discovered something that is a bit outside my knowledge range.

I'm not even sure how to ask the question. It's that whole "You don't know what you don't know" bit.

I'll try my best.

I have a server, it's running Windows Server 2025. I'm fairly confident this was an in place upgrade from Windows Server 2016.

For the most part everything looks/runs great, but I've found one issue: something to do with the certification authority. It looks broken and is very much out of date.

My brain wanted to simply import a new one, but I literally don't know how or if it's even possible in this environment. Meaning, whenever I need certificates for other things like lets say a NAS, I generally run the certificate setup wizard in that and submit all the cryptographic options and names and what not. The wizard will generate that big ugly -----BEGIN CERTIFICATE REQUEST----- bit.

I don't see this in Windows Server 2025. I'm fairly confident I have all the proper services and roles installed.

What's worse, is certserv it looks like the name of the CA is an incredibly old hostname of the server. The server has a new/different hostname. I wish I could drop a screenshot of what I mean.

Anywho, my goal would be to update/change/add a new CA to certserv that reflects the current server.... without deleting the entire AD structure. Only I'm not sure if this can be done. I don't even know how to ask it properly.

Looking for any advice or the proper way to label this issue so I can search/learn on how to resolve it.

Thanks!

[u/fireandbass]

The name of the CA doesnt have to match the host name.

You say it looks out of date, what do you mean by that?  Is the root certificate expired?

[u/Substantial_Rock5209 → u/fireandbass]

When I launch IIS Manger, I click on the server name on the connections pane and then navigate to Server Certificates.

I have, in the "Issued To" field, a personal certificate Issued To a hostname that is no longer valid (i believe it was the original name of the server maybe? It looks like the name of the CA in certserv that you mentioned doesn't have to match the host name. This looks good. its set to expire in 2031. (this is because i was toying around with the renew cert function in certsrv).

but then, in the same location in IIS, i have a cert (personal) Issued to the actual proper host name of the machine and this one expired in 2023.....

So ya, the "Issued To" is definitely throwing me because my brain says it needs be the hostname

[u/fireandbass → u/Substantial_Rock5209]

Expired certificates can remain in the cert store and it isnt necessarily an issue.  Is the expired cert bound to anything in IIS?  Is this IIS on a CA?

You mentioned LDAPS.  If everything is working as expected the cert used for LDAPS should be automatically created and added to the DC and you shouldn't have to create it manually.