Microsoft
MicrosoftMy migration is complete. In case it helps anyone going through this here are some items I came across and did.
I kept the same exact server names across the board.
I migrated the root CA first which being a stand alone was no biggie.
I then did my OCSP responder second. For my environment, before configuring the Online Responder I created a virtual directory in IIS pointing to where I keep the CRL files. My experience was if I didn't do this first, the Online Responder configuration would not work otherwise.
Third I did my Issuing CA. I followed the documentation provided in this thread. I did run into this situation in my lab and in prod....
When I went to issue the templates, none of my configured/duplicated templates showed up in the list of templates on this CA. Here is the fix for that.
Go into a domain controller, open adsiedit.msc Open initial connection, right click on default naming context and properties. Choose the drop for configuration.
Open CN Configuration>CN Services>CN Public Key Services>click on CN Enrollment Services.
On right pane, select and right click on CN="your issuing ca name" and choose properties.
Scroll down to "flags" setting. If it is set to 2, edit this and set it to 10. This indicates to AD that this is an Enterprise CA.
Wait a few minutes for that change to propagate through AD, then a new session of CA management console on your new issuing CA.
