{"id":53970,"date":"2022-08-11T09:00:01","date_gmt":"2022-08-11T07:00:01","guid":{"rendered":"https:\/\/nolabnoparty.com\/?p=53970"},"modified":"2022-08-11T15:02:03","modified_gmt":"2022-08-11T13:02:03","slug":"migrate-root-ca-to-a-new-server","status":"publish","type":"post","link":"https:\/\/nolabnoparty.com\/en\/migrate-root-ca-to-a-new-server\/","title":{"rendered":"Migrate Root CA to a new server"},"content":{"rendered":"<p><img decoding=\"async\" class=\"aligncenter wp-image-54215 size-full\" title=\"migrate-root-ca-to-new-server-01\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/08\/migrate-root-ca-to-new-server-01.jpg\" alt=\"migrate-root-ca-to-new-server-01\" width=\"602\" height=\"202\" \/><\/p>\n<p>If your Microsoft <a href=\"https:\/\/nolabnoparty.com\/en\/office-365-update-ad-fs-ssl-certificate-azure-ad-connect\/\">Certification Authority<\/a> (CA) is running on an obsolete Windows Server version, you need to migrate Root CA to a new server to <strong>keep the support from Microsoft<\/strong>.<\/p>\n<p>You can <strong>directly migrate Root CA<\/strong> to version 2019 if the CA is running on any version of <strong>Windows Server from 2008R2 and later<\/strong>.\u00a0The procedure involves several steps that need to be followed to avoid possible errors.<!--more--><\/p>\n<p>&nbsp;<\/p>\n<h2>Migrate Root CA<\/h2>\n<p>The migrate Root CA procedure to a new server requires the following steps:<\/p>\n<p><strong>Old server<\/strong><\/p>\n<ul>\n<li>Backup the current Root CA<\/li>\n<li>Backup the CA registry key<\/li>\n<li>Remove the CA role<\/li>\n<\/ul>\n<p><strong>New server<\/strong><\/p>\n<ul>\n<li>Install the CA role on the new server<\/li>\n<li>Configure the new CA<\/li>\n<li>Import the private key<\/li>\n<li>Restore the database<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<h2>Backup the current Root CA<\/h2>\n<p>Access the current CA Server and open the <strong>Certification Authority manager<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-54217 size-large\" title=\"migrate-root-ca-to-new-server-02\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/08\/migrate-root-ca-to-new-server-02-600x419.jpg\" alt=\"migrate-root-ca-to-new-server-02\" width=\"600\" height=\"419\" \/><\/p>\n<p>Right click the name of the CA (<em>lab.local<\/em> in the example) and select <strong>All Tasks &gt; Back up CA<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-54219 size-large\" title=\"migrate-root-ca-to-new-server-03\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/08\/migrate-root-ca-to-new-server-03-600x419.jpg\" alt=\"migrate-root-ca-to-new-server-03\" width=\"600\" height=\"419\" \/><\/p>\n<p>The <strong>Certification Authority Backup Wizard<\/strong> opens. Click <strong>Next<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-54221 size-full\" title=\"migrate-root-ca-to-new-server-04\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/08\/migrate-root-ca-to-new-server-04.jpg\" alt=\"migrate-root-ca-to-new-server-04\" width=\"499\" height=\"400\" \/><\/p>\n<p>This article has been written for\u00a0<a href=\"https:\/\/www.starwindsoftware.com\/blog\/\" target=\"_blank\" rel=\"noopener noreferrer\">StarWind blog<\/a>\u00a0and can be found in\u00a0<a href=\"https:\/\/www.starwindsoftware.com\/blog\/migrate-root-ca-to-a-new-server\" target=\"_blank\" rel=\"noopener\">this page<\/a>. It covers the full procedure to <strong>migrate an existing Root CA to a new server<\/strong> retaining all settings configured.<\/p>\n<p>&nbsp;<\/p>\n<h4>Restore the database<\/h4>\n<p>Open the <strong>Certification Authority manager<\/strong> and right click the CA name and select <strong>All Taks &gt; Restore CA<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-54223 size-large\" title=\"migrate-root-ca-to-new-server-05\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/08\/migrate-root-ca-to-new-server-05-600x419.jpg\" alt=\"migrate-root-ca-to-new-server-05\" width=\"600\" height=\"419\" \/><\/p>\n<p>The <strong>Certification Authority Restore Wizard<\/strong> opens. Click <strong>Next<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-54225 size-full\" title=\"migrate-root-ca-to-new-server-06\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/08\/migrate-root-ca-to-new-server-06.jpg\" alt=\"migrate-root-ca-to-new-server-06\" width=\"499\" height=\"398\" \/><\/p>\n<p>Select both <strong>Private key and CA certificate<\/strong> and <strong>Certificate database and certificate database log<\/strong> options. Click <strong>Browse<\/strong> and select the location where the database is located then click <strong>Next<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-54227 size-full\" title=\"7migrate-root-ca-to-new-server-07\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/08\/migrate-root-ca-to-new-server-07.jpg\" alt=\"migrate-root-ca-to-new-server-07\" width=\"499\" height=\"398\" \/><\/p>\n<p>Enter the <strong>Password<\/strong> to gain access to the private key and click <strong>Next<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-54229 size-full\" title=\"migrate-root-ca-to-new-server-08\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/08\/migrate-root-ca-to-new-server-08.jpg\" alt=\"migrate-root-ca-to-new-server-08\" width=\"499\" height=\"398\" \/><\/p>\n<p>Click <strong>Finish<\/strong> to restore the database.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-54231 size-full\" title=\"migrate-root-ca-to-new-server-09\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/08\/migrate-root-ca-to-new-server-09.jpg\" alt=\"migrate-root-ca-to-new-server-09\" width=\"499\" height=\"398\" \/><\/p>\n<p>Click <strong>Yes<\/strong> to start <em>Active Directory Certificate Services<\/em>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-54233 size-full\" title=\"migrate-root-ca-to-new-server-10\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/08\/migrate-root-ca-to-new-server-10.jpg\" alt=\"migrate-root-ca-to-new-server-10\" width=\"412\" height=\"172\" \/><\/p>\n<p>The migrated Root CA is now fully working with <strong>all data migrated<\/strong> from the old CA.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-54235 size-large\" title=\"migrate-root-ca-to-new-server-11\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/08\/migrate-root-ca-to-new-server-11-600x419.jpg\" alt=\"migrate-root-ca-to-new-server-11\" width=\"600\" height=\"419\" \/><\/p>\n<p>Once the migration of the <a href=\"https:\/\/docs.microsoft.com\/en-us\/windows-server\/networking\/core-network-guide\/cncg\/server-certs\/server-certificate-deployment-overview\" target=\"_blank\" rel=\"noopener\">Certification Authority<\/a> has been completed, the old CA server can be <strong>safely dismissed<\/strong>.<\/p>\n<p>Read the\u00a0<a href=\"https:\/\/www.starwindsoftware.com\/blog\/migrate-root-ca-to-a-new-server\" target=\"_blank\" rel=\"noopener\">full article<\/a>\u00a0on StarWind blog.<\/p>\n<p><img decoding=\"async\" title=\"signature\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/images\/firma.jpg\" alt=\"signature\" \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>If your Microsoft Certification Authority (CA) is running on an obsolete Windows Server version, you need to migrate Root CA to a new server to keep the support from Microsoft. You can directly migrate Root CA to version 2019 if the CA is running on any version of Windows Server from 2008R2 and later.\u00a0The procedure involves several steps that need to be followed to avoid possible errors.<\/p>\n","protected":false},"author":3,"featured_media":54215,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rop_custom_images_group":[],"rop_custom_messages_group":[],"rop_publish_now":"initial","rop_publish_now_accounts":{"linkedin_93tdZWzMZc_93tdZWzMZc":"","facebook_2879994398731222_17841400390232720":"","twitter_113568041_113568041":"","mastodon_115463926174894442_115463926174894442":""},"rop_publish_now_history":[],"rop_publish_now_status":"pending","footnotes":""},"categories":[913,1065],"tags":[2488,2487,1572],"class_list":["post-53970","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-active-directory-en","category-microsoft-en","tag-migrate-en","tag-root-ca","tag-server-en","has_thumb"],"_links":{"self":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts\/53970","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/comments?post=53970"}],"version-history":[{"count":0,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts\/53970\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/media\/54215"}],"wp:attachment":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/media?parent=53970"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/categories?post=53970"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/tags?post=53970"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}