Root CA migration: what a headache

[Duke5A]

Well, I've inherited a mess. I have a domain controller with certificate services installed on it and it's passing out certs to the entire network of about 1500 machines. The time has come to migrate to 2012R2 and this is stopping me from doing so. I'm a total noob when it comes to PKI, so please take it easy on me.

 

Here is what I have:

• A 2008R2 DC with Certificate Services installed that needs to be demoted
  
• All joined machines in the domain are getting certs issue to them
  
• Two other domain controllers have the NPS role installed to authenticate our wireless network. Radius is using certs supplied from the CA.
  

 

What I know:

• It is a horrible idea for a CA to be installed on a DC from a security standpoint. Also, this prevents me from demoting the DC while the Certificate Services role is installed.
  
• From what I read what I can do backup the CA role, uninstall it, demote, reinstall CA role, import settings from backup - this scares the crap out of me.
  
• Doing the above will still stick me with a CA name that makes it look like a DC.
  
• I need a plan before I go messing around with this - a long term plan.
  
• It's recommended to have a root CA that issues certs to an intermediary and the intermediary in turn issues to clients while the root remains off. Is this entirely necessary for a school network? I don't exactly have an abundance of Windows Server licenses to burn.
  

 

Questions:

• Our NPS servers are configured with PEAP. Is it possible to use a self-signed cert?
  
• If a CA is a requirement, is it possible to stand another up and migrate over?
  

 

 

So, what is the best course of action? As far as I can tell the only thing that uses the certs issued by the CA are the two NPS servers. If I could put an axe in the CA altogether it would be preferable.

 

I've been doing a lot of reading, but damn, is it mind numbing. Everyone links to whitepapers or complete books on PKI. I just don't see my requirements being that complex, but I do want to set this up right.

 

Thanks for any insight...

Edited November 23, 2015 by Duke5A

[computer_expert]

Questions:

• Our NPS servers are configured with PEAP. Is it possible to use a self-signed cert?
  

 

My NPS server seems to be OK with a self signed certificate (the only reason I do this is I don't have any spare metal to set ADCS up on).

 

• It's recommended to have a root CA that issues certs to an intermediary and the intermediary in turn issues to clients while the root remains off. Is this entirely necessary for a school network? I don't exactly have an abundance of Windows Server licenses to burn.
  

 

If you set up an offline root CA along with a intermediate CA you may be able to do this using virtualization, as the Server 2012R2 licencing allows you to set up a hyper v host (just hyperv on the bare metal, nothing else) and have 2 virtual instances of 2012 R2 running as VMs.

 

I can't really help with any of the other points but hope the above helps you.

[HPlum78]

I have been through this process more than once moving from 2003 > 2012R2 and it may seem scary but its not all that bad, and strictly speaking you are correct in large enterprises you would in normal practice separate the roles out and be able to stop the CA running. But like you say its not always that clear cut and having the lics to do this is a cost that is sometimes just not available. As for not having a CA I don't think some of the services that run on networks would be so easy to deploy without an internal PKI/ CA infrastructure. It all comes down to risk, you clearly don't have your DC's in the DMZ and how likely is it that someone on your internal network is going to sit and find exploits on your internal DC's only you have the answers to I suppose.

 

 

Hate not having a definitive answer but stuff like this has a lot of drivers and when IT need more resource that conversation more often ends up with you can take a 5% cut!

[3s-gtech]

It wasn't so bad when we moved our NPS and ADCS servers to new virtual hardware on 2012 R2. Regenerate certs, push them out - that was the general gist. We don't use NPS for our wireless clients but it does handle our BYOD, and our ADCS server manages anything on the domain that needs an internal cert (e.g. Lync, Office Web Apps etc).

[Duke5A]

I had to wait for a major vacation before attempting this again, but it's done and all is well. It was pretty easy and what I did was this:

 

1. Changed wireless connection GPO to not validate server certificates on clients
   
2. Followed MS guide on migrating certificate services (required backing up the database and keys and exporting a registry key).
   
3. Uninstalled the role from the old DC
   
4. Installed role onto new box
   
5. Reimported the configuration and merged the reg key
   
6. Renewed certs on the NPS boxes
   
7. Changed wireless connection GPO on clients to validate certificates again
   
8. Drink beer
   

Just an update...

 

I know this isn't a very detailed breakdown, but following the MS guide makes is pretty easy. Thanks guys.