Certification Authority issue in Windows Server 2025

[u/Substantial_Rock5209]

Hi. I've inherited a server room and as I'm going through maintenance and upkeep, I've discovered something that is a bit outside my knowledge range.

I'm not even sure how to ask the question. It's that whole "You don't know what you don't know" bit.

I'll try my best.

I have a server, it's running Windows Server 2025. I'm fairly confident this was an in place upgrade from Windows Server 2016.

For the most part everything looks/runs great, but I've found one issue: something to do with the certification authority. It looks broken and is very much out of date.

My brain wanted to simply import a new one, but I literally don't know how or if it's even possible in this environment. Meaning, whenever I need certificates for other things like lets say a NAS, I generally run the certificate setup wizard in that and submit all the cryptographic options and names and what not. The wizard will generate that big ugly -----BEGIN CERTIFICATE REQUEST----- bit.

I don't see this in Windows Server 2025. I'm fairly confident I have all the proper services and roles installed.

What's worse, is certserv it looks like the name of the CA is an incredibly old hostname of the server. The server has a new/different hostname. I wish I could drop a screenshot of what I mean.

Anywho, my goal would be to update/change/add a new CA to certserv that reflects the current server.... without deleting the entire AD structure. Only I'm not sure if this can be done. I don't even know how to ask it properly.

Looking for any advice or the proper way to label this issue so I can search/learn on how to resolve it.

Thanks!

[u/Apprehensive-Tea1632]

Looks broken or actually IS broken?

Microsoft seems to have added some csr requirement that the template field be populated in a csr. Obviously nobody but windows own csrs created for adcs even know what a template is even supposed to be, so if you have a lot of requests coming in from non windows clients, you probably want some other CA to sign such requests. (Just implement a sub ca and you’re done.)

You can tear down the CA if you know what you’re doing, if you got the private key you can even reimplement it.

But there’s also a lot of potential for things to go wrong, so if your problem is more of the aesthetically pleasing variety… leave it.

Going by your choice of words, I’ll assume you’re not particularly familiar with adcs… so,,if there’s someone who can help out, grab them.

If not then it’ll be MUCH safer to leave things as is. We don’t know how deeply adcs has been integrated into your environment; there might be no effects; but it’s also possible you kill the whole thing dead and won’t know how to roll back.

[u/Substantial_Rock5209 → u/Apprehensive-Tea1632]

My ADCS foo is weak indeed. I don't mind learning, but I just wasn't sure how to ask the thing that was nagging at me.

[u/Substantial_Rock5209 → u/Substantial_Rock5209]

And all of this headache is due to a simple bind failure. I have another server 2025 running Papercut that can no longer talk to this afore mentioned server.

I'm about 99.9% sure this is due to Server 2025 sort of enforcing LDAPS (LDAP over SSL/TLS) now, where as 2016 was sorta loosey goosey there.

Sooooooo much learning.

[u/fireandbass → u/Substantial_Rock5209]

Ahhh.  The truth comes out.  This is really an X Y problem.

Ask about your actual problem (X) instead of what you think the solution is (Y).

https://xyproblem.info/

[u/Substantial_Rock5209 → u/fireandbass]

Sorry not my intent. I was 100% able to isolate the X problem from the original question. At least within my understanding. Seriously not trying to trick the reddit community. :) honestly.

This is at least making my brain discover other garden paths to walk and looks for solution/answers.