Hi, Can someone help me with this issue please. We have a AD domain and forest functional level of 2012 in our environment. (NB: not 2012r2) and at the moment it cannot be raised to 2012r2 or higher due to an old Sharepoint server that we still have in production. My question is this: Can we migrate the CA which is running on a WS2012r2 to WS2022 while we still have a AD forest and domain functional level of 2012. Some documentation i found on the internet say that it is possible on domain\forest level from 2012r2 but no one mentions from domain\forest level of 2012. Thanks Melvin Saliba

Hi @ Melvin Saliba I confirm that you don't need to raise the domain and forest functional level in order to be able to install new CA on windows 2022. The link below shows you what do you need to deploy CA on windows 2022 https://learn.microsoft.com/en-us/windows-server/networking/core-network-guide/cncg/server-certs/install-the-certification-authority Please don't forget to accept helpful answer and close this thread

Microsoft CA migration from WS2012R2 to WS2022 but domain and functional level still 2012 not 2012r2

Accepted answer

Thameur-BOURBITA 32,586 Reputation points

2023-12-27T12:32:36.8533333+00:00

Hi @Melvin Saliba

I confirm that you don't need to raise the domain and forest functional level in order to be able to install new CA on windows 2022.

The link below shows you what do you need to deploy CA on windows 2022

https://learn.microsoft.com/en-us/windows-server/networking/core-network-guide/cncg/server-certs/install-the-certification-authority

Please don't forget to accept helpful answer and close this thread
Please sign in to rate this answer.

1 person found this answer helpful.
Melvin Saliba 20 Reputation points

2023-12-27T12:57:21.1233333+00:00

Hello Thameur,

Thanks for you fast response.

I will follow the instructions you have sent me and will keep updating on this thread.

Melvin

Thameur-BOURBITA 32,586 Reputation points

2023-12-27T13:15:27.05+00:00

@Melvin Saliba

You are welcome.

Please don't forget to accept helpful answer

Melvin Saliba 20 Reputation points

2023-12-27T13:50:19.54+00:00

Hi Thameur,

I have checked the attached link and it does not say that a domain\forest functional level of 2012 is supported or not supported.

Also please note that we are doing a migration not an upgrade to ws2022

Thanks

Melvin

Thameur-BOURBITA 32,586 Reputation points

2023-12-27T17:43:10.8+00:00

@Melvin Saliba

It is normal that he does not talk about the minimum functional level required since there is no dependency between Certificate autority and functional level.

Below is another article from Microsoft that does not talk about the functional level.

You can test this in a test environment first.

https://learn.microsoft.com/en-us/windows-server/networking/core-network-guide/cncg/server-certs/server-certificate-deployment

Another link confirm that's no depe,cy between functional level and CA:

Certificate Services and AD Forest Level

Please don't forget to accept helpful answer

Melvin Saliba 20 Reputation points

2023-12-28T07:51:34.1366667+00:00

Hello Thameur,

Migration was done successfully today. However when doing some testing such as with command: certutil -config {configstring} -ping we get:

CertUtil: -ping command FAILED: 0x800706ba (WIN32: 1722 RPC_S_SERVER_UNAVAILABLE)

CertUtil: The RPC server is unavailable.

Is it possible to help us with this?

Thanks

Melvin

Thameur-BOURBITA 32,586 Reputation points

2023-12-28T09:35:08.4733333+00:00

@Melvin Saliba

Can you please open new thread for this error and close this one by accepting helpful answer ?

The RPC server is unavailable.

I think you are facing the same error mentioed in the links below:

https://www.gradenegger.eu/en/the-request-for-a-certificate-fails-with-error-message-the-encryption-certificate-for-the-certification-authority-ca-could-not-be-retrieved-error-the-rpc-server-is-unavailable/

https://www.encryptionconsulting.com/how-to-fix-the-rpc-server-is-unavailable-error/

Please don't forget to accept helpful answer
Sign in to comment

Microsoft CA migration from WS2012R2 to WS2022 but domain and functional level still 2012 not 2012r2

0 additional answers