Server Certificate issue

Question

Recently I decommsioned the old sub ca and set up a new sub CA. We have auto enrollment policy for all the domain computers. So I deleted the certificate issued by the old Sub CA for one of our servers but I didn't see the server request new certificate from the new sub CA. I noticed that the server is still pointing to the old certificate policy server. How can I change it? Thanks

Answer 1

Hello there,

You can try to completely delete all your Old certificates. Certutil deletedbad will just remove old invalidate certificates from the DC.

Certutil tries to validate all the DC certificates that are issued to the domain controllers. Certificates that do not validate are removed. So if you are sure and confident that you do not have CA requirements and Certificate requirement from the DC you run the command. However as a precaution step I would always backup my DC and servers before I run the command or script.

You can look into this thread for similar discussion https://social.technet.microsoft.com/Forums/systemcenter/en-US/ed1b00b9-8036-4812-bc3e-b96e52cee14a/old-certificate-server-in-large-ad-environment-not-properly-removed?forum=winserverDS

How to move a certification authority to another server https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/move-certification-authority-to-another-server

I hope this information helps. If you have any questions please let me know and I will be glad to help you out.

--------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept it as an answer--

Answer 2

Hi Kevin,

You will need to configure the Certificate Enrollment policy on the new server, configure-the-server-certificate-template
migrate-ad-certificate-services-to-a-new-server
How_to_set_up_automatic_certificate_enrollment_in_Active_Directory

Hope this helps.

==
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.