How to move a certification authority to another server (298138)


The information in this article applies to:

  • Microsoft Windows Server 2003, Enterprise Edition
  • Microsoft Windows Server 2003, Standard Edition
  • Microsoft Windows 2000 Advanced Server
  • Microsoft Windows 2000 Server
This article was previously published under Q298138
Important This article contains information about how to modify the registry. Make sure to back up the registry before you modify it. Make sure that you know how to restore the registry if a problem occurs. For information about how to back up, restore, and modify the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows registry

IN THIS TASK

SUMMARY

This article describes how to move a certification authority (CA) to a different server.

Certification authorities (CAs) are the central component of the public key infrastructure (PKI) of an organization. The CAs are configured to exist for many years or decades, during which time the hardware that hosts the CA is probably upgraded.

Notes
  • To move a CA from a server that is running Windows 2000 Server to a server that is running Windows Server 2003, you must first upgrade the CA server that is running Windows 2000 Server to Windows Server 2003. Then you can follow the steps that are outlined in this article.
  • Make sure that the %Systemroot% of the target server matches the %Systemroot% of the server from which the system state backup is taken.

    You must change the path of the CA files when you install the CA server components so that they match the location of the backup. For example, if you back up from the D:\Winnt\System32\Certsrv folder, you must restore the backup to the D:\Winnt\System32\Certsrv folder. You cannot restore the backup to the D:\Windows\System32\Certsrv folder. After you restore the backup, you can move the CA database files to the default location.

    If you try to restore the backup, and the %Systemroot% of the backup and the target server do not match, you may receive the following error message:
    Restore of an incremental image cannot be performed before you perform restore from a full image. The directory name is invalid. 0x8007010b (WIN32/HTTP:267)


back to the top

Back up and restore the certification authority keys and database

Windows Server 2003

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall your operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.
  1. Note the certificate templates that are configured in the Certificate Templates folder in the Certification Authority snap-in. The Certificate Templates settings are stored in Active Directory. They are not automatically backed up. You must manually configure the Certificate Templates settings on the new CA to maintain the same set of templates.

    Note The Certificate Templates folder exists only on an enterprise CA. Stand-alone CAs do not use certificate templates. Therefore, this step does not apply to a stand-alone CA.
  2. Use the Certification Authority snap-in to back up the CA database and private key. To do this, follow these steps:
    1. In the Certification Authority snap-in, right-click the CA name, click All Tasks, and then click Back up CA to start the Certification Authority Backup Wizard.
    2. Click Next, and then click Private key and CA certificate.
    3. Click Certificate database and certificate database log.
    4. Use an empty folder as the backup location. Make sure that the backup folder can be accessed by the new server.
    5. Click Next. If the specified backup folder does not exist, the Certification Authority Backup Wizard creates it.
    6. Type and then confirm a password for the CA private key backup file.
    7. Click Next, and then verify the backup settings. The following settings should be displayed:
      • Private Key
      • CA Certificate Issued Log
      • Pending Requests
    8. Click Finish.
  3. Save the registry settings for this CA. To do this, follow these steps:
    1. Click Start, click Run, type regedit in the Open box, and then click OK.
    2. Locate and then right-click the following registry subkey:

      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration

    3. Click Export.
    4. Save the registry file in the CA backup folder that you defined in step 2d.
  4. Remove Certificate Services from the old server.
  5. Rename the old server, or permanently disconnect it from the network.
  6. Install Certificate Services on the new server. To do this, follow these steps.

    Note The new server must have the same computer name as the old server.
    1. In Control Panel, double-click Add or Remove Programs.
    2. Click Add/Remove Windows Components, click Certificate Services in the Windows Components Wizard, and then click Next.
    3. In the CA Type dialog box, click the appropriate CA type.
    4. Click Use custom settings to generate the key pair and CA certificate, and then click Next.
    5. Click Import, type the path of the .P12 file in the backup folder, type the password that you chose in step 2f, and then click OK.
    6. In the Public and Private Key Pair dialog box, verify that Use existing keys is checked.
    7. Click Next two times.
    8. Accept the Certificate Database Settings default settings, click Next, and then click Finish to complete the Certificate Services installation.
  7. Stop the Certificate Services service.
  8. Locate the registry file that you saved in step 3, and then double-click it to import the registry settings. If the path that is shown in the registry export from the old CA differs from the new path, you must adjust your registry export accordingly. By default, the new path is C:\Windows in Windows Server 2003.
  9. Use the Certification Authority snap-in to restore the CA database. To do this, follow these steps:
    1. In the Certification Authority snap-in, right-click the CA name, click All Tasks, and then click Restore CA.

      The Certification Authority Restore Wizard starts.
    2. Click Next, and then click Private key and CA certificate.
    3. Click Certificate database and certificate database log.
    4. Type the backup folder location, and then click Next.
    5. Verify the backup settings. The Issued Log and Pending Requests settings should be displayed.
    6. Click Finish, and then click Yes to restart Certificate Services when the CA database is restored.
  10. In the Certification Authority snap-in, manually add or remove certificate templates to duplicate the Certificate Templates settings that you noted in step 1.


back to the top

Windows 2000 Server

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall your operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.
  1. Note the certificate templates that are configured in the Certificate Templates folder in the Certification Authority snap-in. The Certificate Templates settings are stored in Active Directory. They are not automatically backed up. You must manually configure the Certificate Templates settings on the new CA to maintain the same set of templates.

    Note The Certificate Templates folder exists only on an enterprise CA. Stand-alone CAs do not use certificate templates. Therefore, this step does not apply to a stand-alone CA.
  2. Use the Certification Authority snap-in to back up the CA database and private key. To do this, follow these steps:
    1. In the Certification Authority snap-in, right-click the CA name, click All Tasks, and then click Back up CA to start the Certification Authority Backup Wizard.
    2. Click Next, and then click Private key and CA certificate.
    3. Click Issued certificate log and pending certificate request queue.
    4. Use an empty folder as the backup location. Make sure that the backup folder can be accessed by the new server.
    5. Click Next. If the specified backup folder does not exist, the Certification Authority Backup Wizard creates it.
    6. Type and then confirm a password for the CA private key backup file.
    7. Click Next two times, and then verify the backup settings. The following settings should be displayed:
      • Private Key
      • CA Certificate Issued Log
      • Pending Requests
    8. Click Finish.
  3. Save the registry settings for this CA. To do this, follow these steps:
    1. Click Start, click Run, type regedit in the Open box, and then click OK.
    2. Locate and then right-click the following registry subkey:

      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration

    3. Click Configuration , and then click Export Registry File on the Registry menu.
    4. Save the registry file in the CA backup folder that you defined in step 2d.
  4. Remove Certificate Services from the old server.
  5. Rename the old server, or permanently disconnect it from the network.
  6. Install Certificate Services on the new server. To do this, follow these steps.

    Note The new server must have the same computer name as the old server.
    1. In Control Panel, double-click Add/Remove Programs.
    2. Click Add/Remove Windows Components, click Certificate Services in the Windows Components Wizard, and then click Next.
    3. In the Certification Authority Type dialog box, click the appropriate CA type.
    4. Click Advanced Options, and then click Next.
    5. In the Public and Private Key Pair dialog box, click Use existing keys, and then click Import.
    6. Type the path of the .P12 file in the backup folder, type the password that you chose in step 2f, and then click OK.
    7. Click Next, type a CA description if appropriate, and then click Next.
    8. Accept the Data Storage Location default settings, click Next, and then click Finish to complete the Certificate Services installation.
  7. Stop the Certificate Services service.
  8. Locate the registry file that you saved in step 3, and then double-click it to import the registry settings.
  9. Use the Certification Authority snap-in to restore the CA database. To do this, follow these steps:
    1. In the Certification Authority snap-in, right-click the CA name, click All Tasks, and then click Restore CA.

      The Certification Authority Restore Wizard starts.
    2. Click Next, and then click Issued certificate log and pending certificate request queue.
    3. Type the backup folder location, and then click Next.
    4. Verify the backup settings. The following settings should be displayed:
      • Issued Log
      • Pending Requests
    5. Click Finish, and then click Yes to restart Certificate Services when the CA database is restored.
  10. In the Certification Authority snap-in, manually add or remove certificate templates to duplicate the Certificate Templates settings that you noted in step 1.


back to the top
Modification Type:MinorLast Reviewed:10/10/2006
Keywords:kbCertServices kbenv kbHOWTOmaster w2000certsrv KB298138 kbAudITPro
©2004 Microsoft Corporation. All rights reserved.