How to decommission an AD CA with active templates

Question

I have been asked to decommission an old CA in my domain. There are about 8 domain controllers with old certificates in the cert store, along with active LDAPS2 and ldaps 2.1 templates. We need to keep only the root CA, but I see certificates for old CAs and old CAs in AD. What is the best way to clean up this situation? I have found some helpful information, but nowhere have I come across a similar situation. Thanks.

Answer 1

Hello,

Thank you for posting in Q&A forum.

Based on your description, we suggest that you refer to the following steps for operation:

Revoke the certificate of the old CA on the CA server and ensure that the certificate of the old CA is deleted on all domain controllers in the domain.

Use the Active Directory Users and Computers or ADSI Edit tool to delete objects related to the old CA in AD. Ensure to backup AD data before operation.

Ensure updating the LDAPS template for use with the new CA. You may need to reissue the LDAPS certificate.

Ensure to check the certificate store on the domain controller and delete all certificates related to the old CA. Ensure that only the root CA certificate is retained.

During the cleaning process, regularly monitor event logs and certificate issuance to ensure that all operations proceed smoothly.

Before performing these steps, it is recommended that you back up all critical data and certificates to prevent unexpected situations from occurring

Best regards，

Jill Zhou

---

If the Answer is helpful, please click "Accept Answer" and upvote it.