Blog Post

ITOps Talk Blog
4 MIN READ

Step-By-Step: Migrating The Active Directory Certificate Service From Windows Server 2008 R2 to 2019

AnthonyBartolo's avatar
AnthonyBartolo
Icon for Microsoft rankMicrosoft
Jun 18, 2019

End of support for Windows Server 2008 R2 has been slated by Microsoft for January 14th 2020.  Said announcement increased interest in a previous post detailing steps on Active Directory Certificate Service migration from server versions older than 2008 R2.  Many subscribers of ITOpsTalk.com have reached out asking for an update of the steps to reflect Active Directory Certificate Service migration from 2008 R2 to 2016 / 2019 and of course our team is happy to oblige. This post contains steps on migrating the Active Directory Certificate Service to Windows Server 2019 that contains the same name. Check out this new post detailing steps on migrating the service to a newly named server should that be required.

 

Step 1: Backup Windows Server 2008 R2 certificate authority database and its configuration
 

  1. Log in to Windows 2008 R2 Server as member of local administrator group
  2. Go to Start > Administrative Tools > Certificate Authority
  3. Right Click on Server Node > All Tasks > Backup CA
     
    Certification Authority Backup CA
     
  4. Click Next on the Certification Authority Backup Wizard screen
  5. Click both check boxes to select both items to backup and provide the backup path for the file to be stored
     
    Certification Authority Backup Wizard Item Selection
     
  6. Click Next
  7. Provide a password to protect private key and CA certificate file and click on next to continue
  8. Click Finish to complete the process

Step 2: Backup CA Registry Settings

 

  1. Click Start > Run > type regedit and click OK
  2. Expand the key in following path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc
  3. Right click on the Configuration key and click Export
  4. Provide a name, save the backup file and then click on save to complete the backup
     
    Backup CA Registry Settings

Backup of the Certificates is now complete and the files can now be moved to the new Windows 2016 / 2019 server.

 

CA Backup complete

 

Step 3: Uninstall CA Service from Windows Server 2008 R2

 

  1. Navigate to Server Manager
  2. Click Remove Roles under Roles Summary to start the Remove Roles Wizard, and then click Next
     
    Uninstalling a CA

  3. Click to clear the Active Directory Certificate Services check box and click Next
     
    Removing Active Directory Certificate Services
     
  4. Click Remove on the Confirm Removal Options page
  5. If Internet Information Services (IIS) is running and you are prompted to stop the service before you continue with the uninstall process, click OK
  6. Click Close
  7. Restart the server to complete the uninstall

Step 4: Install Windows Server 2016 / 2019 Certificate Services

 

*NOTE: The new 2016 / 2019 server needs to have the same "Name" as this point.  The screenshots below show the server name as WS2019 to highlight which server we are working on. This step-by-step highlights screenshots from Windows Server 2019. Windows Server 2016 process is the same with similar screenshots
 

  1. Log in to Windows Server 2019 as Domain Administrator or member of local administrator group
  2. Navigate to Server Manager > Add roles and features
  3. Click on next to continue in the Add Roles and features Wizard
  4. Select Role-based or Feature-based installation and click next
  5. Keep the default selection from the server selections window and click next
     
    Windows Server 2019 Server Selections
     
  6. Select Active Directory Certificate Services, click next in the pop up window to acknowledge the required features that need to be added, and click next to continue
     
    Adding Active Directory Certificate Services
     
  7. Click Next in the Features section to continue
  8. Review the brief description about AD CS and click next to continue
  9. Select Certificate Authority and Certification Authority Web Enrollment, click next in the pop up window to acknowledge the required features that need to be added, and click next to continue
     
    Windows Server 2019 Add Role Services
     
  10. Review the brief description about IIS and click next to continue
  11. Leave the default and click next to continue
  12. Click Install to begin the installation process
  13. Close the wizard once it is complete

 

Step 5: Configure AD CS

 

In this step will look in to configuration and restoring the backup created previously

 

  1. Navigate to Server Manager > AD CS
  2. In right hand panel it will show message as following screenshot and click on More
     
    AD CS
     
  3. Click on Configure Active Directory Certificate Service …… in the pop up window
     
    Configure Active Directory Certificate Service
     
  4. In the Role Configuration wizard, ensure the proper credential for Enterprise Administrator is shown and click next to continue
  5. Select Certification Authority and Certification Authority Web Enrollment and click next to continue
  6. Ensure Enterprise CA is selected the setup type and click next to continue
  7. Select Root CA as the CA type and click next to continue
  8. With this being a migration, select Use existing private key and Select a certificate and use its associated private key and click next to continue
     
    AD CS Configuration
     
  9. Click Import in the AD CS Configuration window
  10. Select the key backed up during the backup process from windows 2008 R2 server. Browse and select the key from the backup we made and provide the password we used for protection and click OK.
     
    Import Existing Certificate
     
  11. With the key successfully imported and select the imported certificate and click next to continue
  12. Leave the default certificate database path and click next to continue
  13. Click on configure to proceed with the configuration process
  14. Close the configuration Wizard once complete

 

Step 6: Restore CA Backup

 

  1. Navigate to Server Manager > Tools > Certification Authority
  2. Right click on server node > All Tasks > Restore CA
  3. A window will appear confirming the stop of Active Directory Certificate Services. Click OK to continue.
     
    Confirm stop of Active Directory Certificate Services
  4. Click Next to start the Certification Authority Restore Wizard
  5. Click both check boxes to select both items to restore and provide the backup path for the file to be restored from
     
    Certification Authority Restore Wizard
  6. Enter the password used to protect private key during the backup process and click next
  7. Click Finish to complete the restore process
  8. Click Yes to restart Active Directory Certificate Services

 

Step 7: Restore Registry info

 

  1. Navigate to the folder with the backed up registry key and double click > Run to initialize the restore
  2. Click yes to proceed with registry key restore
  3. Click OK once confirmation about the restore is shared

 

Step 8: Reissue Certificate Templates

 

It is now time to reissue the certificate with the migration process now complete.

 

  1. Under Server Manager, navigate to Tools > Certification Authority
  2. Right click on Certificate Templates Folder > New > Certificate Template to Reissue
  3. From the certificate templates list click on the appropriate certificate template and click OK

 

This concludes the Active Directory Certificate Service migration steps

 

The following video also shares steps surrounding this process as well as migrating DNS.

 

Updated Jul 09, 2021
Version 9.0
Anthony Bartolo
Windows Server
  • AnthonyBartolo's avatar
    AnthonyBartolo
    Icon for Microsoft rankMicrosoft
    Jun 18, 2019

    bradfore44 - Yes in this scenario the old server and new server would need to have the same name.  I am currently working on writing another post that will address the need to have servers with different names.  Stay tuned.

  • Paul_Adare's avatar
    Paul_Adare
    Icon for Microsoft rankMicrosoft
    Dec 12, 2019

    RasmusJohnsen I am the Feature PM at Microsoft for ADCS and I need to point out some issues in your replies:

     

    1. When migrating from 2008R2 to 2016 or 2019 the interim step of going to 2012R2 first is not required. That interim step is only required if you're starting with 2008 or earlier.
    2. Your comment about removing all but the 4 entries from the registry backup is also not required.
    3. Your reply regarding using certutil to add custom templates after a migration is a workaround and not a real solution. Occasionally, during a migration a couple of things may happen that prevent you from being able to publish custom templates with the GUI. One solution is to use ADSIEdit and navigate to CN=Configuration | CN=Services | CN=Public Key Services | CN=Enrollment Services. Right click the CA in the right pane that you want to enroll from and click properties. Find the flags attribute; and verify that it is set to 10. If it isn’t set to 10, then set it to 10 using ADSIedit.msc and allow for Active Directory replication to complete. The second thing to try is to run certutil -setreg ca\setupstatus +512 on the CA.

    Hope these clarifications help you folks.

  • Thepkiguy's avatar
    Thepkiguy
    Copper Contributor
    Jul 07, 2019

    Glad you are talking to this point but frankly there are many more details to the migration that is missing. These are all covered in the older, but still applicable and more detailed ADCS Migration Whitepaper. A couple of items of note in your process:

     

    1) A very important step is missing from this and almost every migration doc that MICROSOFT has on this subject. You backup the CA while it is in production which means it could issue certificates after the backup and before you remove the role. I always recommend you note the templates that are installed on the CA, and then remove them from the CA. This prevents any further issuance. Now your backup will be accurate and no issued certificate details will be lost. After moving to the new platform, add back the appropriate templates. 

     

    2) In your backup of files you aren’t including the capolicy.inf file that may be in place and defining very important properties for your CA 

     

    3) When the CA is restored onto a new computer it had a new AD SID. As. Result the CA will not be able to publish its CRL to AD (if so configured) because the old CA computer object was the only one ACL’d to do that. So this object needs to be updated to allow the new computer object to publish the CRL. 

     

  • Paul_Adare's avatar
    Paul_Adare
    Icon for Microsoft rankMicrosoft
    Dec 19, 2019

    RasmusJohnsen I'm not going to argue about this with. As I said, I own Active Directory Certificate Services at Microsoft and this has been tested, and yes, when migrating from 2008 R2 to 2016 or 2019, you do not need the interim step of 2012 R2. The Jet database change that requires this step was implemented after 2008 was released and before 2008 R2 was released.

  • bradfore44's avatar
    bradfore44
    Copper Contributor
    Jun 18, 2019

    Does it matter if new server and old server have different names?

  • rdp21915's avatar
    rdp21915
    Copper Contributor
    Jun 26, 2019
    Anthony Bartolo I put in a ticket with premier support referencing this ticket because I had a few follow up questions, but they came and told me that a upgrade directly from 2008 R2 to 2016/2019 was not supported. I asked them if they had tested this in their lab according to your article and they confirmed that they did. here is their response: "Unfortunately we cannot migrate the CA database directly form Server 2008 R2 to Server 2016 because the JET database engine changed so much between the two versions that if we restore the backup we get a JET version error at startup and the CA won't start. But if we add one more step we can successfully fulfill the above tasks. This additional step is to first restore the DB backup to a Server 2012 R2 CA and then backup the DB again form there. This new backup now can be restored to the Server 2016 CA. " Is this something that you ran into when upgrading directly from 2008 R2 to 2016/2019? I would like to do the upgrade directly from 2008 R2 if possible and not step up to 2012 R2 first. Thanks in advance!
  • RasmusJohnsen's avatar
    RasmusJohnsen
    Copper Contributor
    Oct 16, 2019

    update if you are missing CA templates after the deployment then either go into the ADSI for the confuguration of your AD DC server under : 

    adsi -> configuration -> services -> public key services -> certificate templates  ->in there is all your templates self made and auto generated

     

    The self made ones you need to import by powershell(admin mode) on your CA server:

     

    certutil -SetCAtemplates +your-template-name

     

    if your have a template name with () you need to do this:

     

    certutil -SetCAtemplates +'your-template-name'

     

     

  • Paul_Adare's avatar
    Paul_Adare
    Icon for Microsoft rankMicrosoft
    Dec 19, 2019

    Nathan Lamonski Yes, you can only skip the 2012 R2 step if you're starting with 2008 R2. Anything prior to that requires the 2012 R2 interim step.

  • Paul_Adare's avatar
    Paul_Adare
    Icon for Microsoft rankMicrosoft
    Dec 20, 2019

    GGearon The documentation I was referring to is in regards to performing a migration. The only documentation about needing to go to 2012 R2 as an interim step is documented in the Wiki and specifically refers to 2008 and not to 2008 R2 - https://social.technet.microsoft.com/wiki/contents/articles/37373.migrating-ad-certificate-services-from-windows-server-2008-to-windows-server-2016.aspx

     

    There are loads of articles regarding migration in general, nothing really specific to 2019 but the process is exactly the same.

     

    https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn486805(v%3Dws.11)

  • Dean Chen's avatar
    Dean Chen
    Copper Contributor
    Dec 21, 2019

    Paul_AdareThanks so much for your comments in this post and confirming the current Microsoft Windows 2012 R2 CA migration document works for Windows 2016/2019 CA migration as well. This clears a few doubts in my mind. :=)  It would be nice to have an official Microsoft document that could combine Windows 2012 R2 CA migration document and this post for Windows 2016/2019. It took me for a while to search answers until I found this post. Not sure how many others are still scratching their heads. :=)

     

    GGearonMy thought is that with this post as the guideline for Windows 2016/2019 CA, we just need to follow the steps in Windows 2012 R2 CA migration document that Paul shared. that should be it. Good luck!

     

    AnthonyBartoloThanks for posting this document here too!

     

    Thanks,

    Dean