How to move a certification authority to another server

[patris1]

http://support.microsoft.com/default.aspx?scid=kb;EN-US;298138

This article describes how to move a certification authority (CA) to a different server.

Certification authorities (CAs) are the central component of the public key infrastructure (PKI) of an organization. The CAs are configured to exist for many years or decades, during which time the hardware that hosts the CA is probably upgraded.

Notes

• To move a CA from a server that is running Windows 2000 Server to a server that is running Windows Server 2003, you must first upgrade the CA server that is running Windows 2000 Server to Windows Server 2003. Then you can follow the steps that are outlined in this article.
• Make sure that the %Systemroot% of the target server matches the %Systemroot% of the server from which the system state backup is taken.
  
  You must change the path of the CA files when you install the CA server components so that they match the location of the backup. For example, if you back up from the D:\Winnt\System32\Certlog folder, you must restore the backup to the D:\Winnt\System32\Certlog folder. You cannot restore the backup to the C:\Winnt\System32\Certlog folder. After you restore the backup, you can move the CA database files to the default location.
  
  If you try to restore the backup, and the %Systemroot% of the backup and the target server do not match, you may receive the following error message: Restore of an incremental image cannot be performed before you perform restore from a full image. The directory name is invalid. 0x8007010b (WIN32/HTTP:267)
  
  
  Moving Certificate Services from a 32-bit operating system to a 64-bit operating system or vice-versa may fail with one of the following error messages: The expected data does not exist in this directory.
  
  
  Restore of incremental image cannot be performed before performing restore from a full image 0x8007010b (WIN32/HTTP:267)
  
  
  
  Database format changes from the 32-bit version to the 64-bit version cause incompatibilities, and the restore is blocked. This is similar to the move from Windows 2000 to the Windows Server 2003 CA. However, there is no upgrade path from a 32-bit version of Windows Server 2003 to a 64-bit version. Therefore, you cannot move an existing 32-bit database to a 64-bit database. For more information, click the following article number to view the article in the Microsoft Knowledge Base: 912309 (How to upgrade Windows Server 2003 with Service Pack 1 to Windows Server 2003 R2 ) How to upgrade Windows Server 2003 with Service Pack 1 to Windows Server 2003 R2
• An x64-based version of Windows Server 2003 R2 CD2 only updates 64-bit versions of Windows Server 2003 that are based on the EM64T architecture or on the AMD64 architecture.

Back up and restore the certification authority keys and database

Windows Server 2003

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base: 322756 (How to back up and restore the registry in Windows XP ) How to back up and restore the registry in Windows

1. Note the certificate templates that are configured in the Certificate Templates folder in the Certification Authority snap-in. The Certificate Templates settings are stored in Active Directory. They are not automatically backed up. You must manually configure the Certificate Templates settings on the new CA to maintain the same set of templates.
   
   Note The Certificate Templates folder exists only on an enterprise CA. Stand-alone CAs do not use certificate templates. Therefore, this step does not apply to a stand-alone CA.
2. Use the Certification Authority snap-in to back up the CA database and private key. To do this, follow these steps:
   
   1. In the Certification Authority snap-in, right-click the CA name, click All Tasks, and then click Back up CA to start the Certification Authority Backup Wizard.
   2. Click Next, and then click Private key and CA certificate.
   3. Click Certificate database and certificate database log.
   4. Use an empty folder as the backup location. Make sure that the backup folder can be accessed by the new server.
   5. Click Next. If the specified backup folder does not exist, the Certification Authority Backup Wizard creates it.
   6. Type and then confirm a password for the CA private key backup file.
   7. Click Next, and then verify the backup settings. The following settings should be displayed:
      
      • Private Key and CA Certificate
      • Issued Log and Pending Requests
   8. Click Finish.
3. Save the registry settings for this CA. To do this, follow these steps:
   
   1. Click Start, click Run, type regedit in the Open box, and then click OK.
   2. Locate and then right-click the following registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\CertSvc\Configuration
   3. Click Export.
   4. Save the registry file in the CA backup folder that you defined in step 2d.
4. Remove Certificate Services from the old server.
   
   Note This step removes objects from Active Directory. Do not perform this step out of order. If removal of the source CA is performed after installation of the target CA (step 6 in this section), the target CA will become unusable.
5. Rename the old server, or permanently disconnect it from the network.
6. Install Certificate Services on the new server. To do this, follow these steps.
   
   Note The new server must have the same computer name as the old server.
   
   1. In Control Panel, double-click Add or Remove Programs.
   2. Click Add/Remove Windows Components, click Certificate Services in the Windows Components Wizard, and then click Next.
   3. In the CA Type dialog box, click the appropriate CA type.
   4. Click Use custom settings to generate the key pair and CA certificate, and then click Next.
   5. Click Import, type the path of the .P12 file in the backup folder, type the password that you chose in step 2f, and then click OK.
   6. In the Public and Private Key Pair dialog box, verify that Use existing keys is checked.
   7. Click Next two times.
   8. Accept the Certificate Database Settings default settings, click Next, and then click Finish to complete the Certificate Services installation.
7. Stop the Certificate Services service.
8. Locate the registry file that you saved in step 3, and then double-click it to import the registry settings. If the path that is shown in the registry export from the old CA differs from the new path, you must adjust your registry export accordingly. By default, the new path is C:\Windows in Windows Server 2003.
9. Use the Certification Authority snap-in to restore the CA database. To do this, follow these steps:
   
   1. In the Certification Authority snap-in, right-click the CA name, click All Tasks, and then click Restore CA.
      
      The Certification Authority Restore Wizard starts.
   2. Click Next, and then click Private key and CA certificate.
   3. Click Certificate database and certificate database log.
   4. Type the backup folder location, and then click Next.
   5. Verify the backup settings. The Issued Log and Pending Requests settings should be displayed.
   6. Click Finish, and then click Yes to restart Certificate Services when the CA database is restored.
   
   
   Note You may receive the following error during the restore CA process if the CA backup folder is not in the correct folder structure format: ---------------------------
   Microsoft Certificate Services
   ---------------------------
   The expected data does not exist in this directory.
   Please choose a different directory. The directory name is invalid. 0x8007010b (WIN32/HTTP: 267)
   
   
   The correct folder structure is as follows:
   C:\Ca_Backup\CA_NAME.p12
   C:\Ca_Backup\Database\certbkxp.dat
   C:\Ca_Backup\Database\edb#####.log
   C:\Ca_Backup\Database\CA_NAME.edb
   
   where C:\Ca_Backup is the folder you chose during the Backup CA phase in step 2.
10. In the Certification Authority snap-in, manually add or remove certificate templates to duplicate the Certificate Templates settings that you noted in step 1.

Windows 2000 Server

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base: 322756 (How to back up and restore the registry in Windows XP ) How to back up and restore the registry in Windows

1. Note the certificate templates that are configured in the Certificate Templates folder in the Certification Authority snap-in. The Certificate Templates settings are stored in Active Directory. They are not automatically backed up. You must manually configure the Certificate Templates settings on the new CA to maintain the same set of templates.
   
   Note The Certificate Templates folder exists only on an enterprise CA. Stand-alone CAs do not use certificate templates. Therefore, this step does not apply to a stand-alone CA.
2. Use the Certification Authority snap-in to back up the CA database and private key. To do this, follow these steps:
   
   1. In the Certification Authority snap-in, right-click the CA name, click All Tasks, and then click Back up CA to start the Certification Authority Backup Wizard.
   2. Click Next, and then click Private key and CA certificate.
   3. Click Issued certificate log and pending certificate request queue.
   4. Use an empty folder as the backup location. Make sure that the backup folder can be accessed by the new server.
   5. Click Next. If the specified backup folder does not exist, the Certification Authority Backup Wizard creates it.
   6. Type and then confirm a password for the CA private key backup file.
   7. Click Next two times, and then verify the backup settings. The following settings should be displayed:
      
      • Private Key and CA Certificate
      • Issued Log and Pending Requests
   8. Click Finish.
3. Save the registry settings for this CA. To do this, follow these steps:
   
   1. Click Start, click Run, type regedit in the Open box, and then click OK.
   2. Locate and then right-click the following registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\CertSvc\Configuration
   3. Click Configuration , and then click Export Registry File on the Registry menu.
   4. Save the registry file in the CA backup folder that you defined in step 2d.
4. Remove Certificate Services from the old server.
   
   Note This step removes objects from Active Directory. Do not perform this step out of order. If removal of the source CA is performed after installation of the target CA (step 6 in this section), the target CA will become unusable.
5. Rename the old server, or permanently disconnect it from the network.
6. Install Certificate Services on the new server. To do this, follow these steps.
   
   Note The new server must have the same computer name as the old server.
   
   1. In Control Panel, double-click Add/Remove Programs.
   2. Click Add/Remove Windows Components, click Certificate Services in the Windows Components Wizard, and then click Next.
   3. In the Certification Authority Type dialog box, click the appropriate CA type.
   4. Click Advanced Options, and then click Next.
   5. In the Public and Private Key Pair dialog box, click Use existing keys, and then click Import.
   6. Type the path of the .P12 file in the backup folder, type the password that you chose in step 2f, and then click OK.
   7. Click Next, type a CA description if appropriate, and then click Next.
   8. Accept the Data Storage Location default settings, click Next, and then click Finish to complete the Certificate Services installation.
7. Stop the Certificate Services service.
8. Locate the registry file that you saved in step 3, and then double-click it to import the registry settings.
9. Use the Certification Authority snap-in to restore the CA database. To do this, follow these steps:
   
   1. In the Certification Authority snap-in, right-click the CA name, click All Tasks, and then click Restore CA.
      
      The Certification Authority Restore Wizard starts.
   2. Click Next, and then click Issued certificate log and pending certificate request queue.
   3. Type the backup folder location, and then click Next.
   4. Verify the backup settings. The following settings should be displayed:
      
      • Issued Log
      • Pending Requests
   5. Click Finish, and then click Yes to restart Certificate Services when the CA database is restored.
10. In the Certification Authority snap-in, manually add or remove certificate templates to duplicate the Certificate Templates settings that you noted in step 1.

For more information about upgrade and migration scenarios for Windows Server 2003 and Windows Server 2008, see the "Active Directory Certificate Services Upgrade and Migration Guide" white paper. To download the white paper, visit the following Microsoft Download Center Web site: Download details: Active Directory Certificate Services Upgrade and Migration Guide for Windows Server 2008 (Download details: Active Directory Certificate Services Upgrade and Migration Guide for Windows Server 2008)



APPLIES TO

• Microsoft Windows Server 2003, Enterprise x64 Edition
• Microsoft Windows Server 2003, Standard x64 Edition
• Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
• Microsoft Windows Server 2003, Standard Edition (32-bit x86)
• Microsoft Windows 2000 Advanced Server
• Microsoft Windows 2000 Server

---

موضوعات مشابه:

• Move کردن DNS به سرور جدید
• Installing and Configuring a Windows Server 2003 Enterprise Certification Authority
• Certificate authority

---

[patris1]

http://support.microsoft.com/?scid=kb%3Ben-us%3B555012&x=11&y=6

HOWTO: Move a certificate authority to a new server running on a domain controller.

Author: Francis Ouellet MVP

This whitepaper assumes the reader is knowledgeable with Windows Server 2003 Active Directory services, certificate services and backing up registry keys.

domain.com is the FQDN of your Active Directory infrastructure.
SERVER-01 is the name of the old server being demoted.
SERVER-02 is the new server being brought in.
CA_NAME is the name of your Certificate Authority.



Step One: Prepare the forest.

Raise the Active Directory functional level to Windows Server 2003. Read KB 322692 for more info.
Backup Certificate Authority using the MMC.
Backup the following registry key [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\CertSvc\Configuration\CA_NAME].
Delete the CA cryptographic keys (See KB article 298138)




Step Two: Remove the certificate server.



Type the following command in a command box.
Type “certutil –shutdown” to stop Certificate Services.
Type “certutil –key” to list the cryptographic keys installed on the server.
Type “certutil –delkey CA_NAME” to delete the key.
The certicate service can safely be removed.



Step Three: Remove the old Domain Controller from the domain.



In order to have at least one Global Catalog in your domain make sure that the server being removed isn’t the only one owing this role.
Run dcpromo.exe on SERVER-01 and remove this DC from AD.
Remove the old computer account from AD.
Once you’ve restarted; rename the member server.
Look at the DNS to see if all records pointing to the old DC have been removed. “_tcp.dc._msdcs.domain.com.”comes to mind.
Promote SERVER-02 as a DC by running dcpromo.exe



Step Four: Rename the computer account.



After installing the Windows Server 2003 Support Tools on SERVER-02 type in this command to add a new alternate name (the name must be a FQDN followed by a primary DNS suffix.)
C:\Program Files\Support Tools>”netdom computername SERVER-02 /add:SERVER-01.domain.com”
Once the command has completed make the server primary using this command:
C:\Program Files\Support Tools>”netdom computername SERVER-02 /makeprimary:SERVER-01.domain.com”
I ran into this error:

Unable to make SERVER-01.domain.com the primary name for the computer.
The error is:
The account already exists.

Active Directory already contains a Computer Account or a Server Object with the specified name: SERVER-01.

If these objects are associated with an existing computer in the domain then this name cannot be made primary.

If these objects are not associated with an existing computer, it may have been improperly renamed or removed from the domain. Remove them from Active
Directory and retry the make primary operation.

The following tools can be used to locate and remove these objects:
For Computer Account - Active Directory Users and Computers.
For Server Object - Active Directory Sites and Services.

The command failed to complete successfully.

I Removed the server account from Sites and Services and it seems to have solved the problem.
Reboot the server
Remove the old server name using this command:
C:\Program Files\Support Tools>“netdom computername SERVER-01 /remove:SERVER-02.domain.com”
Make sure you don’t have any “leftover” computer names by typing this:
C:\Program Files\Support Tools>“netdom computername SERVER-01 /enumerate”
Install the certificate service as explained in KB article 298138.
Restore the certificate server from the backup taken in step two.
Import the old registry key.
If you wish to move the certificate data to another folder you may do so by following the instruction in this KB article (283193)




The author is a Windows system administrator located in Montreal, Quebec; He can be reached at francis@francisouellet.ca


APPLIES TO

• Microsoft Windows Server 2003, Standard Edition (32-bit x86)
• Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
• Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)

COMMUNITY SOLUTIONS CONTENT DISCLAIMERMICROSOFT CORPORATION AND/OR ITS RESPECTIVE
 SUPPLIERS MAKE NO REPRESENTATIONS ABOUT THE SUITABILITY, RELIABILITY, OR ACCURACY OF
 THE INFORMATION AND RELATED GRAPHICS CONTAINED HEREIN. ALL SUCH INFORMATION AND 
RELATED GRAPHICS ARE PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT AND/OR 
ITS RESPECTIVE SUPPLIERS HEREBY DISCLAIM ALL WARRANTIES AND CONDITIONS WITH REGARD TO 
THIS INFORMATION AND RELATED GRAPHICS, INCLUDING ALL IMPLIED WARRANTIES AND 
CONDITIONS OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, WORKMANLIKE EFFORT, 
TITLE AND NON-INFRINGEMENT. YOU SPECIFICALLY AGREE THAT IN NO EVENT SHALL MICROSOFT 
AND/OR ITS SUPPLIERS BE LIABLE FOR ANY DIRECT, INDIRECT, PUNITIVE, INCIDENTAL, SPECIAL, 
CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER INCLUDING, WITHOUT LIMITATION, 
DAMAGES FOR LOSS OF USE, DATA OR PROFITS, ARISING OUT OF OR IN ANY WAY CONNECTED WITH 
THE USE OF OR INABILITY TO USE THE INFORMATION AND RELATED GRAPHICS CONTAINED HEREIN, 
WHETHER BASED ON CONTRACT, TORT, NEGLIGENCE, STRICT LIABILITY OR OTHERWISE, EVEN IF 
MICROSOFT OR ANY OF ITS SUPPLIERS HAS BEEN ADVISED OF THE POSSIBILITY OF DAMAGES.

[patris1]

http://technet.microsoft.com/en-us/library/cc755153%28WS.10%29.aspx

Move a CA to a Different Computer



Certification authorities (CAs) are configured to exist for many years or decades, during which time you may want to upgrade the hardware and operating system that supports the CA.
Moving a CA from one computer to a second computer involves the following procedures:

• Backing up the CA on the first computer
• Restoring the CA on the second computer

You must also confirm that the computer that you are restoring the CA on has the same name as the computer that you backed up the CA from. If the name is different, see article 298138 in the Microsoft Knowledge Base (How to move a certification authority to another server).
To move a CA from a server that is running Windows Server 2003 to a server that is running Windows Server® 2008, you can either complete the Windows upgrade first and then move the CA or move the CA first and then upgrade Windows.

• To upgrade Windows first: Upgrade the first server from Windows Server 2003 to Windows Server 2008, back up the CA on this server, and then restore the CA on a second server running Windows Server 2008.
• To move the CA first: Back up the CA on a computer running Windows Server 2003, restore the CA on a second computer running Windows Server 2003, and then upgrade the second server to Windows Server 2008.

You must be a CA administrator to complete this procedure. For more information, see Implement Role-Based Administration.
To back up a CA

1. Open the Certification Authority snap-in.
2. If you are backing up an enterprise CA, click Certificate Templates for the CA, and record the names of the certificate templates that are listed.
   Note Certificate template settings are stored in Active Directory Domain Services (AD DS) and are not automatically backed up. You will need to manually add the certificate templates that you need to the new CA.
3. In the Certification Authority snap-in, right-click the CA name, click All Tasks, and then click Back up CA to start the Certification Authority Backup Wizard.
4. Click Next, and select the Private key and CA certificate and Certificate database and certificate database log check boxes.
5. Specify an empty folder or storage media as the backup location, and then click Next.
6. Type a password for the CA private key backup file, and type it a second time to confirm the password.
7. Click Next, verify that the Private Key and CA Certificate and Issued Log and Pending Requests backup settings are displayed, and then click Finish.
8. Click Start, click Run, type regedit, and then click OK.
   Caution Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on your computer.
9. Locate and right-click the following registry subkey:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\CertSvc\Configuration
10. Click Export.
11. Save the registry file in the CA backup folder that you used for the Certification Authority Backup Wizard.
12. Uninstall the CA from the old server, and then rename the old server or permanently disconnect it from the network.

Before you begin the restore procedure, confirm that the %Systemroot% folder of the target server running Windows Server 2008 matches the %Systemroot% folder of the server from which the backup is taken.
In addition, the location of the CA restore must match the location of the CA backup. For example, if you back up the CA from the D:\Winnt\System32\Certlog folder, you must restore the backup to the D:\Winnt\System32\Certlog folder. After you restore the backup, you can move the CA database files to a different location.
Membership in local Administrators, or equivalent, is the minimum required to complete this procedure. If this is an enterprise CA, membership in DomainAdmins, or equivalent, is the minimum required to complete this procedure. For more information, see Implement Role-Based Administration.
To restore a CA on a new server from a backup copy

1. Open Server Manager, and click Active Directory Certificate Services. Click Next two times.
2. On the Select Role Services page, select the Certification Authority check box, and then click Next.
3. On the Specify Setup Type page, click either Standalone or Enterprise, and then click Next.
   For more information, see Types of Certification Authorities.
   Note You must have a network connection to a domain controller in order to install an enterprise CA.
4. On the Specify CA Type page, click the appropriate CA type, and then click Next.
5. On the Set Up Private Key page, click Use existing private key, click Select a certificate and use its associated private key, and then click Next.
6. On the Select Existing Certificate page, click Import, type the path of the .P12 file in the backup folder, type the password that you chose in the previous procedure to protect the backup file, and then click OK.
7. In the Public and Private Key Pair dialog box, verify that Use existing keys is selected.
8. Click Next two times.
9. On the Configure Certificate Database page, specify the same location for the certificate database and certificate database log as on the previous CA computer. Click Next.
   For more information, see Certificates Database.
10. On the Confirm Installation Options page, review all of the configuration settings that you have selected. If you want to accept all of these options, click Install and wait until the setup process has finished.
11. Open the Services snap-in to stop the Active Directory Certificate Services (AD CS) service.
12. Locate the registry file that you saved in the backup procedure, and then double-click it to import the registry settings. If the path that is shown in the registry export from the old CA differs from the new path, you must adjust your registry export accordingly.
    Caution Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on your computer.
13. Open the Certification Authority snap-in, right-click the CA name, click All Tasks, and then click Restore CA to open theCertification Authority Restore Wizard.
14. Click Next, and select the Private key and CA certificate and Certificate database and certificate database log check boxes.
15. Type the backup folder location, and then click Next.
16. Verify the backup settings. The Issued Log and Pending Requests settings should be displayed.
17. Click Finish, and then click Yes to restart AD CS when the CA database is restored.
18. If this is an enterprise CA, restore the certificate templates from AD DS that you recorded in the previous procedure. For more information, see Add a Certificate Template to a Certification Authority.

Additional references

Setting Up a Certification Authority

[patris1]

http://www.microsoft.com/downloads/details.aspx?FamilyID=c70bd7cd-9f03-484b-8c4b-279bc29a3413&displaylang=en

Active Directory Certificate Services Upgrade and Migration Guide for Windows Server 2008

Brief Description

This document discusses the planning and implementation of a Windows Server 2008 Active Directory Certificate Services (AD CS) upgrade and migration from an existing Windows public key infrastructure (PKI), including scenarios and step-by-step instruction

Overview

This guide describes the planning and implementation of an upgrade and migration from an existing Windows public key infrastructure (PKI) to Windows Server 2008. It describes common migration scenarios, identifies features and scenarios that are supported and recommended, and provides step-by-step instructions for the most common tasks. It also offers general guidance for creating an upgrade and migration plan that is specific to your environment

Related Resources

1. Active Directory Certificate Services Upgrade and Migration Guide on Technet

What Others Are Downloading

Others who downloaded Active Directory Certificate Services Upgrade and Migration Guide for Windows Server 2008 also downloaded:

1. AD CS Step-By-Step Guide
2. Microsoft SCEP Implementation Whitepaper.
3. Certificate Enrollment Web Services in Windows Server 2008 R2
4. Best Practices for Implementing a Microsoft Windows Server 2003 Public Key Infrastructure
5. Windows Server 2003 PKI Operations Guide