Certificate Authority Migration - CDP Location #1 Unable to Download

Question

Certificate Authority Migration - CDP Location #1 Unable to Download

Justin Mattingly 0

I am following the guide published here https://learn.microsoft.com/en-us/troubleshoot/windows-server/certificates-and-public-key-infrastructure-pki/move-certification-authority-to-another-server

To Migrate Certificate authority from an ancient server (2012R2) to a new VM (2022 datacenter).

I've backed up the DB/private key and the regkey has been exported successfully

The issue I am encountering is tied to the PKIVIEW.

-The new server will have a different hostname from the old server

-From PKIVIEW I can see my CA certificate is fine, my AIA Location#1 is fine, but my CDP Location#1 is reporting "Unable to Download".

In my Location info for AIA I have an LDAP entry stating something like:

ldap:///CN=Business-Business.Server-CA, CN AIA, CN=Public. . .objectClass=certificationAuthority

In my location info for CDP I have http://business-server/CertEnroll/Business-Business-Server-CA.crl

The url does not resolve

If I navigate to C:\Windows\System32\Certsrv\CertEnroll I can actually see the crl file there

I have two main questions-

What can I do to resolve the immediate problem of the CDP location being unavailable?
1. I've tried manually republishing the revocation list but that does not appear to have done anything I can see.
On the new server (When I'm standing the new CA box up) will I need to reference this older server in the CDP and CRL configuration? How and where would I do that?

Bonus question that may demonstrate my ignorance:

If this server is going to stop being used for CA and will eventually be decommissioned entirely, is there an option for me to just create this CRL on the new server? I'm trying to understand why I need to reference the old CRL and CDP info for a server that will have the role uninstalled.

I don't have a lot of experience working on this so I'm a bit confused, trying to take notes as I research.

Justin Mattingly 0 Reputation points

2025-11-20T21:02:35.8766667+00:00

Additional note.

Certutil -crl results in 0x80070002 WIN#2: 2 ERROR_FILE_NOT_FOUND

I guess my real question here is, does this matter that much?

If I have the registry key & db information, in addition to the CDP info, could I safely remove the CA role for this older server add the CA role onto my new server without user disruption?

Again, from my understanding, the new server is going to completely replace the old server. I'm getting a bit confused with this specific segment of the tutorial microsoft has provided:

"Active Directory Certificate Services (AD CS) is configured with certificate revocation list (CRL) Distribution Point extensions that include the CA computer host name in the path. This means that any certificates issued by the CA before the migration may contain certificate validation paths with the old host name. These paths may no longer be valid after the migration. To avoid revocation checking errors, the new CA must be configured to publish CRLs to the old (pre-migration) paths and the new paths. If you have to delete the old CA permanently, you can add a second computer name to the new CA. Before you can do that, the old computer name needs to be available in Active Directory. At this point, you can add the CRL Distribution Points to the new CA."
Justin Mattingly 0 Reputation points

2025-11-21T13:41:09.1166667+00:00

I appreciate your help- I think there may be some odd settings on this older server. The default site- in fact just about all of the sites are stopped on this server, this makes sense since back in 2019 most IIS services were migrated to a dedicated app server.

Cert enroll is just a directory, not a site.

This server is (unfortunately) the root authority, I've determined that via the command line. I'm trying to figure out whether there were mistakes made during the migration or if I'm just missing something.
Kate Pham (WICLOUD CORPORATION) 280 Reputation points Microsoft External Staff Moderator

2025-11-24T02:42:40.96+00:00

Hi @Justin Mattingly

Thank you for your response and the updates!

Please let us know if you have any questions and kindly accept my answer if it was helpful.
Justin Mattingly 0 Reputation points

2025-11-24T14:54:42.68+00:00

I have additional questions for sure-

1 answer

Your answer

Justin Mattingly 0 Reputation points

2025-11-20T21:02:35.8766667+00:00

Additional note.

Certutil -crl results in 0x80070002 WIN#2: 2 ERROR_FILE_NOT_FOUND

I guess my real question here is, does this matter that much?

If I have the registry key & db information, in addition to the CDP info, could I safely remove the CA role for this older server add the CA role onto my new server without user disruption?

Again, from my understanding, the new server is going to completely replace the old server. I'm getting a bit confused with this specific segment of the tutorial microsoft has provided:

"Active Directory Certificate Services (AD CS) is configured with certificate revocation list (CRL) Distribution Point extensions that include the CA computer host name in the path. This means that any certificates issued by the CA before the migration may contain certificate validation paths with the old host name. These paths may no longer be valid after the migration. To avoid revocation checking errors, the new CA must be configured to publish CRLs to the old (pre-migration) paths and the new paths. If you have to delete the old CA permanently, you can add a second computer name to the new CA. Before you can do that, the old computer name needs to be available in Active Directory. At this point, you can add the CRL Distribution Points to the new CA."
Justin Mattingly 0 Reputation points

2025-11-21T13:41:09.1166667+00:00

I appreciate your help- I think there may be some odd settings on this older server. The default site- in fact just about all of the sites are stopped on this server, this makes sense since back in 2019 most IIS services were migrated to a dedicated app server.

Cert enroll is just a directory, not a site.

This server is (unfortunately) the root authority, I've determined that via the command line. I'm trying to figure out whether there were mistakes made during the migration or if I'm just missing something.
Kate Pham (WICLOUD CORPORATION) 280 Reputation points Microsoft External Staff Moderator

2025-11-24T02:42:40.96+00:00

Hi @Justin Mattingly

Thank you for your response and the updates!

Please let us know if you have any questions and kindly accept my answer if it was helpful.
Justin Mattingly 0 Reputation points

2025-11-24T14:54:42.68+00:00

I have additional questions for sure-

Answer 1

Kate Pham (WICLOUD CORPORATION) 280 Microsoft External Staff Moderator

Hi Justin Mattingly,

Thank you for contacting Q&A community!

Allow me to summarize the current background information. Please let me know if I’m misunderstanding anything!

After checking PKI view on RootCA:

AIA Location#1 is OK
CDP Location#1: Unable To Download
When you tried to access to the URL: [http://business-server/CertEnroll/Business-Business-Server-CA.crl], failed to resolve

Possible cause: The CRL file exists locally, but IIS (for that URL/hostname is not reachable, so PKIView reports “Unable to Download”.

Technically, the url link is hosted by IIS, please help refer bellow instruction to set up IIS configuration:

Open IIS Manager
Navigate to the CertEnroll Site:
- Under Sites, click Default Web Site
- In the Features View, locate and click CertEnroll
Directory Browsing: Enabled
Anonymous Authentication: Enabled
Windows Authentication: Disabled

Moreover, please help temporally turned off the HTTP redirect if your current configuration is forcing to HTTPS

Then, as you mentioned when you navigate to C:\Windows\System32\Certsrv\CertEnroll and it contains the crl files, please help check:

On the RootCA server, make sure CDP location is pointing to the correct crl file. Update/add the HTTP CDP if needed
Copy C:\Windows\System32\Certsrv\CertEnroll on the RootCA server and paste it into same folder path on Enterprise CA server

After that, restart the PKI service and check to see if the Status of CDP Location is Ok yet.

Feel free to reach out if you have further concern relate to above steps.

If you believe this information adds some value, please accept the answer so that your experience with the issue would help contribute to the whole community.

Best wishes!

Kate,

Justin Mattingly 0 Reputation points

2025-12-03T17:44:44.54+00:00

I appreciate your help- I think there may be some odd settings on this older server. The default site- in fact just about all of the sites are stopped on this server, this makes sense since back in 2019 most IIS services were migrated to a dedicated app server.

Cert enroll is just a directory, not a site.

This server is (unfortunately) the root authority, I've determined that via the command line. I'm trying to figure out whether there were mistakes made during the migration or if I'm just missing something.
Justin Mattingly 0 Reputation points

2025-12-03T17:48:54.03+00:00

I don't need to know the nuts and bolts of how to fix this if it isn't necessary. This is an old server. If the revocation list, which based on what I can see has not been updated in quite some time, doesn't matter that much, I am happy to take the intact and functioning Reg Key and Configuration files, which are current, and import them in my new CA server.
Kate Pham (WICLOUD CORPORATION) 280 Reputation points Microsoft External Staff Moderator

2025-12-04T00:53:59.4+00:00
Thanks for sharing that! If the revocation list hasn’t been updated in a long time and you’re okay moving forward without it, then importing the current registry keys and configuration files from your old CA to the new one is a practical approach. This will keep your settings intact and help the new CA work as expected.

Just a couple of things to keep in mind:

Make sure the old CA is properly retired after the migration to avoid any conflicts.

Update any services or applications that rely on the CA so they trust the new one.

Kate

Share via

Certificate Authority Migration - CDP Location #1 Unable to Download

1 answer

Your answer