CertUtil: -backupKey command FAILED: 0x80092004 (-2146885628)

Question

I am trying to perform a backup of the CA Database and Private Keys for my old SBS server before migrating to my new server running Windows Server 2019 Standard however when I run the certutil -backupkey command I receive the error "CertUtil: -backupKey command FAILED: 0x80092004 (-2146885628) CertUtil: Cannot find object or property."

Can anybody suggest how to overcome this error?

What would be the implications of not migrating the CA Database and Private Keys?

Thanks

David

Answer 1

Hi,
Thanks for sharing here!
For Migrating The Active Directory Certificate Service, i would recommend you follow the steps in the following link:
https://techcommunity.microsoft.com/t5/itops-talk-blog/step-by-step-migrating-the-active-directory-certificate-service/ba-p/697674
And check if you can backup all the database successfully.
If there are still errors , please feel free to let us know.

Best Regards,

Answer 2

Thanks for coming back to me so quickly. I followed the steps in the link you sent me but received a similar error (see attached screenshots). I click OK after the first message and then received the error.

Answer 3

Can anybody suggest how to overcome this error?

I would say there is no supported way. Your private key is not allowed for export (even for backup purposes), so you can't backup it and transfer to another server. What I can suggest is to start over with brand new CA and issue certificates from new CA. Keep running existing CA until last client certificate is expired. When last certificate expired, you simply decommission old CA.