Share via

Public Key Infra Cert CA upgrade and renew

Ming Cheung 426 Reputation points
2021-04-19T10:14:32.777+00:00

i have PKI which 2012R2 , and Ent CA key is also going to expire, Root CA still have 10 years
i wish to follow a industry standard for upgrade windows to 2019, and renew the CA cert,
i wonder any microsoft recommandation for upgrade and renew
should i moving the existing root CA cert , and renew ent CA cert,
or just renew Root CA and Ent CA cert, ]
i want a documentation or article for supporting
thank you

Windows for business | Windows Server | Devices and deployment | Configure application groups
Answer accepted by question author
  1. Vadims Podāns 9,266 Reputation points MVP
    2021-04-19T10:34:24.033+00:00

    You can do this in any order: renew first than migrate, or migrate first and then renew. For migration guide you can follow official ADCS migration guide: https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn486797(v=ws.11)

2 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2021-04-21T07:36:03.483+00:00

    Hello @Ming Cheung ,

    Thank you for your update.

    We suggest renewal with new key pair.

    For the difference between renewal with existing key pair and renewal with new key pair, you can refer to link below.

    Root CA certificate renewal
    https://social.technet.microsoft.com/wiki/contents/articles/2016.root-ca-certificate-renewal.aspx

    We can backup 2012 R2 and recover cert to 2019, and then renew with new key.
    Or renew with new key, and then backup 2012 R2 and recover cert to 2019.

    For migrate CA from 2012 R2 to 2019, we can refer to steps below (similar steps).
    Step-By-Step: Migrating The Active Directory Certificate Service From Windows Server 2008 R2 to 2019
    https://techcommunity.microsoft.com/t5/itops-talk-blog/step-by-step-migrating-the-active-directory-certificate-service/bc-p/700730#M270%3FWT.mc_id=ITOPSTALK-blog-abartolo

    Considerations for migrating a CA to a new machine:

    1. When migrating a CA, the computer name of the target computer may be different from the computer name of the source computer, but the CA name must remain unchanged.
    2. By default, Active Directory Certificate Services (AD CS) is configured with certificate revocation list (CRL) distribution point extensions, including the CA machine host name in the path. This means that any certificate issued by the CA prior to migration may contain a certificate verification path that contains the old host name. These paths may no longer be valid after migration. To avoid revocation checking errors, the new CA must be configured to publish the CRL to the old (pre-migration) path as well as the new path.
    3. During the installation process, we must choose to use the CA's existing certificate and private key instead of creating a new CA certificate and key.

    Hope the information above is helpful.

    Should you have any question or concern, please feel free to let us know.

    Tip: Each of the above small steps contains a lot of operations.
    It is recommended that you set up a similar CA environment in the test environment, and perform migration and renew operations in the test environment, and then record all these steps in a document, and write down the key points and precautions.
    If there are no problems, follow the similar the steps in the production environment, so that even if you encounter any problems in the production environment, you should be able to troubleshoot or solve them well.

    Best Regards,
    Daisy Zhou

    ============================================

    If the Answer is helpful, please click "Accept Answer" and upvote it.

  2. Anonymous
    2021-04-20T02:28:23.57+00:00

    Hello @Ming Cheung ,

    Thank you for posting here.

    Hope the information provided by Crypt32 is helpful.

    After my research, here are two articles for your references.

    Step-By-Step: Migrating The Active Directory Certificate Service From Windows Server 2008 R2 to 2019
    https://techcommunity.microsoft.com/t5/itops-talk-blog/step-by-step-migrating-the-active-directory-certificate-service/bc-p/700730#M270%3FWT.mc_id=ITOPSTALK-blog-abartolo

    Renew Issuing/Subordinate CA Certificate
    https://www.risual.com/2014/05/renew-issuingsubordinate-ca-certificate/

    Hope the information above is helpful.

    Should you have any question or concern, please feel free to let us know.

    Please note: Information posted in the given link is hosted by a third party. Microsoft does not guarantee the accuracy and effectiveness of information.

    Best Regards,
    Daisy Zhou

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.