How can I upgrade my Windows server 2012 R2 Certificate Authority server to 2019 or later without any issues?

Question

I'm running my certificate server on 2012 and need to know are there any special steps to upgrading to 2019 without losing any settings or having to reconfigure?

Answer 1

Hello Donte_Cates,

Thank you for posting in Microsoft Community forum.

Is your PKI one online Enterprise root CA? If so, we suggest you migrate ADCS from 2012 R2 to 2019 instead of performing in-place upgrade the OS version from Windows server 2012 R2 to Windows server 2019.

Considerations for migrating a CA to a new machine:

1. When migrating a CA, the computer name of the target computer may be different from the computer name of the source computer, but the CA name must keep the same.
2. By default, Active Directory Certificate Services (AD CS) is configured with certificate revocation list (CRL) distribution point extensions, including the CA machine host name in the path. This means that any certificate issued by the CA prior to migration may contain a certificate verification path that contains the old host name. These paths may no longer be valid after migration. To avoid revocation checking errors, the new CA must be configured to publish the CRL to the old (pre-migration) path as well as the new path.
3. During the installation process, we must choose to use the CA's existing certificate and private key instead of creating a new CA certificate and key.

The migrate steps from 2012 R2 to 2019 are similar as from 2008 R2 to 2019 (or from 2003 to 2012 R2)

For more information, please refer to links below.

Step-By-Step: Migrating The Active Directory Certificate Service From Windows Server 2008 R2 to 2019 (microsoft.com)

Step-By-Step: Migrating The Active Directory Certificate Service From Windows Server 2003 to 2012 R2 | Microsoft Learn

Performing the Upgrade or Migration | Microsoft Learn

AD CS Migration: Migrating the Certification Authority | Microsoft Learn

I hope the information above is helpful.

If you have any question or concern, please feel free to let us know.

Best Regards,

Daisy Zhou

Answer 2

Is it better to keep the name of the server the same or what's the process to migrate to a server with a new name?

Answer 3

Hello

Good day!

You can add a new Windows server 2019 (different name as the old CA server)to the same domain.

Then follow the step-by-step migration link.

Best Regards,
Daisy Zhou