Backing Up and Restoring the Certification Authority

2/9/2009

Backing up the certification authority involves modifying the registry, so you should back up the registry before completing the steps below. For detailed information on backing up the certification authority, please visit the following Microsoft Web site: https://go.microsoft.com/fwlink/?LinkId=126935.

In general, you can back up the certification authority keys and database by doing the following:

1. Open the Certification Authority snap-in and navigate to the Certificate Templates folder.

2. Note or copy the certificate template settings that are configured because you must manually configure these settings on the new certification authority.

3. In the Certification Authority snap-in, right-click the certification authority, point to All Tasks, and then select Back up CA.

4. To save the registry settings on the certification authority, open Registry Editor by running regedit.

5. In Registry Editor, locate the following subkey:

   HKLM\System\CurrentControlSet\Services\CertSvc\Configuration
   

6. Right-click the subkey, and then select Export.

7. Save the registry file to a backup folder.

8. If you are migrating the certification authority, remove Certificate Services from the old certification authority, and then rename or disconnect it.

9. To complete the migration or recovery, install Certificate Services on the new certification authority by using Add/Remove Windows Components.

10. Stop the Certificate Services service, and then import the registry settings by double-clicking the registry file that you saved in steps 5 through 7.

To restore the certification authority, do the following:

1. In the Certification Authority snap-in, right-click the certification authority, point to All Tasks, and then select Restore CA.
2. In the Certification Authority snap-in, duplicate the certificate template settings that you noted or copied in step 2.