Do I need a CA/CS in my domain ?

[Linfit]

Need the advice of the collective here as Google is not giving me a clear answer.

 

I am in the process of replacing our 2012r2 DC's with 2019 VM's. Have got most everything sorted, migrated roles, DNS, DHCP and the myriad of other things its easy to forget about, and all is OK.

Three new DC's all up and running and two old ones demoted and removed.

I have one final 2012r2 DC I now want to demote and remove.

 

It has AD Certificate services installed on it and is a CA. I can't demote the box as long as AD CS is installed.

I have researched moving AD CS to another box and although it can be done its tedious and difficult if the new box has a different name.

 

So my question is, can I just uninstall AD CS on this box and go ahead and demote it, and either:

 

1. Not bother with AD CS at all ?

2. Start again on a new server (likely not a DC if possible) without doing the tedious migration ?

 

I know that CS is not required for AD to operate, but looking in the issued certificated list, the only ones that have been issued and are current are for the DC's and are for Domain Controller Authentication, Directory Email Replication, and Kerberos Authentication.

 

We do use Kerberos so don't want to break anything, but also want to take the path of least resistance.

[fredbayker]

Try these guides:

 

https://www.petri.com/migrate-restore-windows-server-2012-r2-certification-authority-to-new-server

 

https://blogs.technet.microsoft.com/pki/2012/01/27/decommissioning-an-old-certification-authority-without-affecting-previously-issued-certificates-and-then-switching-operations-to-a-new-one/

[ITGuyWestMidlands]

If you have wireless windows devices, ideally, you should have a PKI for your wireless authentication

[k-strider]

we use certificates for wireless Auth now (802.1x) and internal web servers for SSL.... years ago i was in the same boat and i was very worried because every domain computer had got issued a cert (from GPO) but it doesn't matter. in the end i created a new CA (also because i needed SHA2 not 1 for webservers) revoked all the issuing roles from the old one the new one then issued out certificates over time as the certs expired the computers got them from the new server - you can force this too... so if your not using the certificates for anything then its fairly safe just to remove it and create a new CA authority should you want to use them in the future.

[Linfit]

@k-strider having done some more reading around this, your post confirms what I have been nudging towards - remove it and start again if we need the infrastructure for something internal in the future. I am going to revoke the certs, see what happens and then remove the role, take it from there. From what I read, it should never have been installed on a DC in the first place.