Blog Post

ITOps Talk Blog
4 MIN READ

Step-By-Step: Migrating The Active Directory Certificate Service From Windows Server 2008 R2 to 2019

AnthonyBartolo's avatar
AnthonyBartolo
Icon for Microsoft rankMicrosoft
Jun 18, 2019
End of support for Windows Server 2008 R2 has been slated by Microsoft for January 14th 2020.  Said announcement increased interest in a previous post detailing steps on Active Directory Certificate ...
Updated Jul 09, 2021
Version 9.0
Anthony Bartolo
Windows Server
GGearon's avatar
GGearon
Copper Contributor
Jun 04, 2020

So I'm currently working on my upgrade from 2008R2 to 2019 servers, in a lab. My environment is as follows.
Standalone Root CA

Enterprise Issuing CA

Enterprise OSCP Responder/CRL holder

 

I basically followed this article step by step to build a new root ca on 2019. Kept the same name all that. Seemed to go fine.

 

Then I followed this article step by step building a new issuing ca on 2019, keeping the same name etc. Went all fine until the end when I did the restore. At the end, it said could not start the ADCS service because of the RPC was not running and could not verify CRLs. From there I rebooted, and launched CA console. The templates showing as issued were the generic versions, not my customized ones. When I try to issue the correct one, I get the same errors. 

 

To move forward with my migration, do I maybe need to build the OCSP Responder/CRL holder server first, before the issuing ca? That way it will see the CRL and be happy? Also, for the OCSP Responder, I assume I just follow this document step by step, but add the role features to go with that? 

 

Thanks