Step-By-Step: Migrating Active Directory Certificate Service From Windows Server 2008 R2 to 2019

Michel_van_Wees - looks like they address that on another MS site: https://techcommunity.microsoft.com/t5/itops-talk-blog/step-by-step-migrating-active-directory-certificate-service-from/ba-p/2328766

 Note

By default, Active Directory Certificate Services (AD CS) is configured with certificate revocation list (CRL) Distribution Point extensions that include the CA computer host name in the path. This means that any certificates issued by the CA before the migration may contain certificate validation paths with the old host name. These paths may no longer be valid after the migration. To avoid revocation checking errors, the new CA must be configured to publish CRLs to the old (pre-migration) paths and the new paths. If you have to delete the old CA permanently, you can add a second computer name to the new CA. Before you can do that, the old computer name needs to be available in Active Directory. At this point, you can add the CRL Distribution Points to the new CA.