Windows 2000 certificate authority migration

I would need to upgrade the Windows DC to Then I would have to perform the steps in Q to transfer the database to the other DC. Does it matter that the second DC has a different name? Once I've transfered the CA, I can uninstall it from the upgraded original server. Then demote it, and remove it from the domain. Is that the correct way? Thanks again, David. Reply to author.

Report message as abuse. We have now completed the installation and restore of the CA server. NOTE , you will need to reissue any certificate templates that were being used. If you do not see, your templates this means you have not restarted the CA services after the import of the backup registry key. This migration would than let the CA support the latest enhanced key storage mechanism and stronger key and signature algorithms. Note, after changing the certificate template Algorithm, if the certificate template is not being listed stop and start the CA service.

I hope this blog post has helped you migrate your existing Microsoft Certificate Authority from a non supported Operating System to a supported Operating System. When you change the hashing algorithm over to a SHA2 algorithm you are going to have to migrate all CA certificates to use the newer Key Storage Providers if you are currently using Cryptographic Service Providers. Step 10 is all about switching over to use SHA2 algorithms, and then starting the Certification Authority back up.

So there you go. For that to happen you would need to do the following:. Once the certification authority has been configured to use SHA2 hashing algorithms. Once this is done double click on one of the CRLs and you will see the new signature algorithm.

As you can tell, not only do newly issued end entity certificates get signed using the SHA2 algorithm, so do all existing CRLs that the CA needs to publish. I would suspect that most of you are like me and would like to err on the side of caution in this regard. Once that has been accomplished, I would test each application in the environment that leverages certificates. When I run into an application that does not support SHA2 I would contact the vendor and get on record when they are going to start supporting SHA2, or ask the application owner when they are planning to stop using the application.