Moving CA from 2008R2 to 2012R2

[timbo343]

Im wanting to move our CA from 2008R2 to 2012R2. This CA only sits there as it's required but hasn't actually given out any certificates (see attached screen shots).

 

When i look in the Pending and Failed requests, i see a lot of pending requests for the DCs of the domain and in the failed requests i see accounts stopped giving failures around 2013.

 

Since ive not accepted any requests, should i create a new CA rather than moving this existing one over?

[Arthur]

It's probably worth creating a new CA since then you can do it properly by creating a separate Root CA and Subordinate CA and ensuring the hash algorithm is at least SHA256.

 

• Deploying an Enterprise Root Certificate Authority
  
• Deploying an Enterprise Subordinate Certificate Authority
  

[timbo343]

Thanks, ill have a look at those articles. Would you place the CA on a specific machine or just add at as another role to an existing DC?

[Arthur]

Would you place the CA on a specific machine or just add at as another role to an existing DC?

Separate (since it would be far less hassle if you ever needed to rebuild that DC).

[timbo343]

Ive been reading and re-reading these documents, i think its safe to say i need to fire up 2 more VMs and the Root one will sit offline. I will do anything not to work on certificates, i hate them!

[timbo343]

After following both guides, i have setup the new CA but on my machine when i look in MMC > Enterprise PKI i see errors on the new CAs.

 

CA Certificate - Status: Unknown Error

AIA Location #1 - Status: Partial Chain

AIA Location #2 - Status: Partial Chain

 

Do i need to export these certificates and place them in the DOMAIN > Trusted Root Certification Authorities store?

 

When i do MMC > Enterprise PKI on the Subordinate server, i see

 

CA Certificate - Status: Revocation Status Unknown.

What does this mean?

 

Event code ID 96

 

Also i notice the certificate expires in 1 year unlike 10 years which my old certificate was.

 

I HATE CERTIFICATES!!!!

 

Im sure this CA doesnt even do anything!

Edited August 23, 2016 by timbo343

[timbo343]

its more hassle than what it's worth isnt it?? Event ID: 96 Source: CertSrv

[timbo343]

Another day wasted on this damm CA server!

 

I thought i'd start again with it, now im getting cannot connect to RPC server when i try to submit a new request on the issuing CA server! Well, of course it wont find the RootCA as the instructions have told me to install the RootCA server away from the Domain!! FFS!!!!!!

 

Someone who has found the answer! http://fix.lazyjeff.com/2014/05/revocation-function-was-unable-to-check.html

 

 

So, after eventually muddling my way through this process, i think i have done it following the documents posted by @Arthur and these documents..

 

https://mizitechinfo.wordpress.com/2013/08/29/step-by-step-deploying-a-standalone-root-ca-in-server-2012-r2-part-1/

https://mizitechinfo.wordpress.com/2013/08/31/step-by-step-deploying-an-enterprise-subordinate-ca-in-server-2012-r2-part-2/ - I think there is an error between steps 35 and 40 in this one so had to refer to arthur's documents.

 

Not done the certificate templates in this article though https://blogs.technet.microsoft.com/yungchou/2013/10/21/enterprise-pki-with-windows-server-2012-r2-active-directory-certificate-services-part-1-of-2/

 

None of the documents add up.

Edited August 24, 2016 by timbo343

[ITGuyWestMidlands]

What is your CA used for? Do you need it?

[timbo343]

What is your CA used for? Do you need it?

 

Ive never used it or needed to use it in the 11 years ive been at work which makes me think why i need one however i do remember taking the 2003 one offine before moving to 2008 and the domain required it.

6 years later, im in the same position .

 

Ive read online that they are needed though.

[ITGuyWestMidlands]

They are not a requirement. Chexh what certs are currently issued to what servers. Then check those servers for services that could be using them. Perhaps radius?