AD CS Migration: Migrating the Certification Authority

1. Choose a backup location and attach media, if necessary.

2. Log on to the source CA.

3. Open the Certification Authority snap-in.

4. Right-click the node with the CA name, point to All Tasks, and then click Back Up CA.

5. On the Welcome page of the CA Backup wizard, click Next.

6. On the Items to Back Up page, select the Private key and CA certificate and Certificate database and certificate database log check boxes, specify the backup location, and then click Next.

7. On the Select a Password page, type a password to protect the CA private key, and click Next.

   Security Note
   Use a strong password; for example, at least eight characters long with a combination of uppercase and lowercase characters, numbers, and punctuation characters.

8. On the Completing the Backup Wizard page, click Finish.

9. After the backup completes, verify the following files in the location you specified:

   • CAName.p12 containing the CA certificate and private key
     
     
   • Database folder containing files certbkxp.dat, edb#####.log, and CAName.edb
     
     

10. Open a Command Prompt window, and type net stop certsvc to stop the Active Directory Certificate Services service.

    Important
    The service should be stopped to prevent issuance of additional certificates. If certificates are issued by the source CA after a database backup is completed, repeat the CA database backup procedure to ensure the database backup contains all issued certificates.

11. Copy all backup files to a location that is accessible from the destination server; for example, a network share or removable media.

    Security Note
    The private key must be protected against compromise. Protect a shared folder by limiting its access control list to authorized CA administrators. Protect removable media against unauthorized access and damage.

1. Log on with local administrative credentials to the CA computer.

2. Open a Command Prompt window.

3. Type Certutil.exe –backupdb <BackupDirectory> and press ENTER.

4. Type Certutil.exe –backupkey <BackupDirectory> and press ENTER.

   Note
   BackupDirectory specifies the directory in which the backup files are created. The specified value can be a relative or absolute path. If the specified directory does not exist, it is created. The backup files are created in a subdirectory named Database.

5. Type a password at the prompt, and press ENTER. You must retain a copy of the password to access the key during CA installation on the destination server.

   Security Note
   Use a strong password; for example, at least eight characters with a combination of uppercase and lowercase characters, numbers, and symbols.

6. Type net stop certsvc and press ENTER to stop the Active Directory Certificate Services service. The service must be stopped to prevent issuance of additional certificates.

7. After the backup completes, verify the following files in the location you specified:

   • CAName.p12 containing the CA certificate and private key
     
     
   • Database folder containing files certbkxp.dat, edb#####.log, and CAName.edb
     
     

8. Copy all backup files to a location that is accessible from the destination server; for example, a network share or removable media.

   Security Note
   The private key must be protected against compromise. Protect a shared folder by granting permission to only authorized CA administrators. Protect removable media against unauthorized access and damage.

1. Log on to the destination server.

2. Start Server Manager.

3. In the console tree, double-click Storage, and click Disk Management.

4. Ensure that the shared storage is online and assigned to the node you are logged on to.

1. Start the Certificates snap-in for the local computer account.

2. In the console tree, double-click Certificates (Local Computer), and click Personal.

3. On the Action menu, click All Tasks, and then click Import to open the Certificate Import Wizard. Click Next.

4. Locate the <CAName>.p12 file created by the CA certificate and private key backup on the source CA, and click Open.

5. Type the password, and click OK.

6. Click Place all certificates in the following store.

7. Verify Personal is displayed in Certificate store. If it is not, click Browse, click Personal, and click OK.

   Note
   If you are using a network HSM, complete steps 8 through 10 to repair the association between the imported CA certificate and the private key that is stored in the HSM.

8. In the console tree, double-click Personal Certificates, and click the imported CA certificate.

9. On the Action menu, click Open. Click the Details tab, copy the serial number to the Clipboard, and then click OK.

10. Open a Command Prompt window, type certutil –repairstore My  "{Serialnumber}" and then press ENTER.

1. Log on to the destination server, and start Server Manager.

2. In the console tree, click Roles.

3. On the Action menu, click Add Roles.

4. If the Before you Begin page appears, click Next.

5. On the Select Server Roles page, select the Active Directory Certificate Services check box, and click Next.

6. On the Introduction to AD CS page, click Next.

7. On the Role Services page, click the Certification Authority check box, and click Next.

   Note
   If you plan to install other role services on the destination server, you should complete the CA installation first, and then install other role services separately. Installation procedures for other AD CS role services are not described in this guide.

8. On the Specify Setup Type page, specify either Enterprise or Standalone, to match the source CA, and click Next.

9. On the Specify CA Type page, specify either Root CA or Subordinate CA, to match the source CA, and click Next.

10. On the Set Up Private Key page, select Use existing private key and Select a certificate and use its associated private key.

    Note
    If an HSM is used by the CA, select the private key by following procedures provided by the HSM vendor.

11. In the Certificates list, click the imported CA certificate, and then click Next.

    Note
    If you are using a custom CSP that requires strong private key protection, click Allow administrator interaction when the private key is accessed by the CA. The CSPs included with Windows Server do not require this setting to be enabled.

12. On the Configure Certificate Database page, specify the locations for the CA database and log files.

    Note
    If you are migrating the CA to a failover cluster, the specified locations for database and log files must be on shared storage that is attached to all nodes. Because the location is common to cluster nodes, click Yes to overwrite the existing CA database as you add the CA role service to other nodes.

    Important
    If you specify locations that are different from the locations used on the source CA, then you must also edit the registry settings backup file before the CA is restored. If the locations specified during setup are different from the locations specified in the registry settings, the CA cannot start.

13. On the Confirm Installation Selections page, review the messages, and then click Install.

14. If you are migrating to a failover cluster, stop the Active Directory Certificate Services service (Certsvc) and HSM service if your CA uses an HSM. Then repeat the procedures to import the CA certificate and add the CA role service on other cluster nodes.

1. Log on to the destination server as a member of the local Administrators group or the Enterprise Admins group.

2. Copy the script Setupca.vbs from AD CS Migration: Appendix A to a directory on the destination server.

3. Copy the directory containing the CA database backup files and CA certificate backup files to a directory on the destination server.

   Important
   The CA database backup files are created in a directory named Database. Copy the entire Database directory, instead of copying only the backup files within the directory.

4. Type certutil.exe -importpfx "<CAName>.p12" and press ENTER.

5. Type the password for the private key, and press ENTER.

6. Type certutil.exe -store my | find "Key Container" and press ENTER.

7. Copy the value of Key Container that follows the equals sign (=). Do not include any leading or trailing spaces.

8. Type Cscript Setupca.vbs /IS /RC /SN "<Key Container Value>"

   Important
   To install a standalone CA, use /IS. To install an enterprise CA, use /IE. The value of <Key Container Name> is the value you copied in the previous step.

9. Type net stop certsvc and press ENTER.

To restore the CA database by using the Certification Authority snap-in

To restore the CA database by using Certutil.exe

1. Right-click the .reg file created by exporting the settings from the source CA.

2. Click Edit to open the file in a text editor.

3. If the target CA's computer name is different from the source CA's computer name, search the file for the host name of the source CA computer. For each instance of the host name found, ensure that it is the appropriate value for the target environment. Change the host name, if necessary. Update the CAServerName value.

   Important
   If the host name is located in the .reg file as part of the CA name, such as in the Active value within the Configuration key or the CommonName value within the CAName key, do not change the setting. The CA name must not be changed as part of the migration. This means the new target CA must have the old CA's name, even if part of that name is the old CA's host name.

4. Check any registry values that indicate local file paths, such as the following, to ensure drive letter names and paths are correct for the target CA. If there is a mismatch between the source and the target CA, either update the values in the file or remove them from the file so that the default settings are preserved on the target CA.

   These storage location settings are elected during CA setup. They exist under the Configuration registry key:

   • DBDirectory
     
     
   • DBLogDirectory
     
     
   • DBSystemDirectory
     
     
   • DBTempDirectory
     
     

   The following settings under the Configuration\{CA Name} registry key contain, in their default values, a local path. (Alternatively, you can update these values after importing them by using the Certification Authority snap-in. The values are located on the CA properties Extensions tab.)

   • CACertPublicationURLs
     
     
   • CRLPublicationURLs
     
     

1. Log on to the destination server as a member of the local Administrators group.

2. Open a Command Prompt window.

3. Type net stop certsvc and press ENTER.

4. Type reg import <Registry Settings Backup.reg> and press ENTER.

1. Click Start, type regedit.exe in the Search programs and files box, and press ENTER to open the Registry Editor.

2. In the console tree, locate the key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\CertSvc\Configuration, and click Configuration.

3. In the details pane, double-click DBSessionCount.

4. Click Hexadecimal. In Value data, type 64, and then click OK.

5. Verify the locations specified in the following settings are correct for your destination server, and change them as needed to indicate the location of the CA database and log files.

   • DBDirectory
     
     
   • DBLogDirectory
     
     
   • DBSystemDirectory
     
     
   • DBTempDirectory
     
     

   Important
   Complete steps 6 through 8 only if the name of your destination server is different from the name of your source server.

6. In the console tree of the registry editor, expand Configuration, and click your CA name.

7. Modify the values of the following registry settings by replacing the source server name with the destination server name.

   Note
   In the following list, CACertFileName and ConfigurationDirectory values are created only when certain CA installation options are specified. If these two settings are not displayed, you can proceed to the next step.

   • CAServerName
     
     
   • CACertFileName
     
     
   • ConfigurationDirectory – This value should appear in Windows Registry under the following location: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\CertSvc\Configuration.
     
     

1. Review and modify the CRL distribution point and authority information access extensions and publishing options by following example procedures described in Specify CRL Distribution Points (http://go.microsoft.com/fwlink/?LinkID=145848).

2. If the destination server name is different from the source server name, add an LDAP URL specifying a location that references the destination server's NetBIOS name with the substitution variable <ServerShortName>; for example ldap:///CN=<CATruncatedName><CRLNameSuffix>,CN=<ServerShortName>,CN=CDP,CN=Public Key Services,CN=Services,<ConfigurationContainer><CDPObjectClass>.

1. Log on with administrative credentials to the destination CA.

2. Open a command prompt window.

3. Type certutil -setcatemplates +<templatelist> and press ENTER.

   Note
   Replace <templatelist> with a comma-separated list of the template names that are listed in the catemplates.txt file created during the procedure "To record a CA templates list by using Certutil.exe." For example, certutil -setcatemplates +Administrator,User,DomainController. Review the list of templates created during Backing up a CA templates list.

1. Click Start, point to Run, type Cluadmin.msc, and then click OK.

2. In the console tree of the Failover Cluster Management snap-in, click Services and Applications.

3. On the Action menu, click Configure a service or Application. If the Before you begin page appears, click Next.

4. In the list of services and applications, select Generic Service, and click Next.

5. In the list of services, select Active Directory Certificate Services, and click Next.

6. Specify a service name, and click Next.

7. Select the disk storage that is still mounted to the node, and click Next.

8. To configure a shared registry hive, click Add, type SYSTEM\CurrentControlSet\Services\CertSvc, and then click OK. Click Next twice.

9. Click Finish to complete the failover configuration for AD CS.

10. In the console tree, double-click Services and Applications, and select the newly created clustered service.

11. In the details pane, click Generic Service. On the Action menu, click Properties.

12. Change Resource Name to Certification Authority, and click OK.

1. Open the Failover Cluster Management snap-in. In the console tree, click Services and Applications.

2. In the details pane, select the previously created name of the clustered service.

3. On the Action menu, click Add a resource, and then click Generic Service.

4. In the list of available services displayed by the New Resource wizard, click the name of the service that was installed to connect to your network HSM. Click Next twice, and then click Finish.

5. Under Services and Applications in the console tree, click the name of the clustered services.

6. In the details pane, select the newly created Generic Service. On the Action menu, click Properties.

7. On the General tab, change the service name if desired, and click OK. Verify that the service is online.

8. In the details pane, select the service previously named Certification Authority. On the Action menu, click Properties.

9. On the Dependencies tab, click Insert, select the network HSM service from the list, and click OK.

1. Log on to a domain member computer as a member of the Domain Admins group or Enterprise Admins group.

2. Click Start, point to Run, type dssite.msc, and then click OK.

3. In the console tree, click the top node.

4. On the View menu, click Show services node.

5. In the console tree, expand Services, then Public Key Services, and then click AIA.

6. In the details pane, right-click the name of the source CA, and then click Properties.

7. Click the Security tab, and then click Add.

8. Click Object Types, click Computers, and then click OK.

9. Type the computer account names of all cluster nodes, and click OK.

10. In the Allow column, select the Full Control check box next to each cluster node, and click OK.

11. In the console tree, click Enrollment Services.

12. In the details pane, right-click the name of the source CA, and then click Properties.

13. Click the Security tab, and then click Add.

14. Click Object Types, click Computers, and then click OK.

15. Type the computer account names of all cluster nodes, and click OK.

16. In the Allow column, select the Full Control check box next to each cluster node, and click OK.

17. In the console tree, click KRA.

18. In the details pane, right-click the name of the source CA, then click Properties.

19. Click the Security tab, and then click Add.

20. Click Object Types, click Computers, and then click OK.

21. Type the names of all cluster nodes, and click OK.

22. In the Allow column, select the Full Control check box next to each cluster node, and click OK.

1. Log on to the active cluster node as a member of the Enterprise Admins group.

2. Click Start, point to Run, type adsiedit.msc, and then click OK.

3. In the console tree, click ADSI Edit.

4. On the Action menu, click Connect to.

5. In the list of well-known naming contexts, click Configuration, and click OK.

6. In the console tree, expand Configuration, Services, and Public Key Services, and click Enrollment Services.

7. In the details pane, right-click the name of the cluster CA, and click Properties.

8. Click dNSHostName, and click Edit.

9. Type the service name of the CA as displayed under Failover Cluster Management in the Failover Cluster Manager snap-in, and click OK.

10. Click OK to save changes.

1. Log on to the active cluster node as a member of the local Administrators group.

2. Click Start, click Run, type regedit, and then click OK.

3. Locate the registry key \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration.

4. Click the name of the CA.

5. In the right pane, double-click CRLPublicationURLs.

6. In the second line, replace %2 with the service name specified in step 6 of the procedure "To configure AD CS as a cluster resource."

   Tip
   The service name also appears in the Failover Cluster Management snap-in under Services and Applications.

7. Restart the CA service.

8. Open a command prompt, type certutil -CRL, and press ENTER.

   Note
   If a "Directory object not found" error message is displayed, complete the following procedure to create the CRL distribution point container in AD DS.

1. At a command prompt, type cd %windir%\System32\CertSrv\CertEnroll, and press ENTER. The CRL file created by the certutil –CRL command should be located in this directory.

2. To publish the CRL in AD DS, type certutil -f -dspublish "CRLFile.crl" and press ENTER.