How to Migrate Certificate Authority from Windows 2008 x86 to Windows 2016

I was recently tasked with migrating to Windows 2016 domain controllers. Easy enough, but one of the old domain controllers had Certificate Authority installed and configured, and that server was a 2008 (not R2) x86 server. After reading lots on 2008 R2 Certificate Authority migrations, I was not finding a lot of information on Windows 2008 x86 migration methods.

Ultimately, the solution is to migrate from Windows 2008 x86 to Windows 2012 R2 first, then migrate from Windows 2012 R2 to Windows 2016. Below is the method I ultimately used successfully.

Applicable Products

• Microsoft Windows 2008 Server x86 with Active Directory Certificate Services installed and configured for the enterprise

• Microsoft Windows 2012 R2 Server

• Microsoft Windows 2016 Server

Procedure

1. Backup the existing certificate authority database and private key. Using the Certificate Authority console on the Windows 2008 server, right-click the Certificate Authority name and select All Tasks > Back up CA. When running through the wizard, select both Private key and CA certificate, and Certificate database and certificate database log when choosing what to back up.

2. Backup the following registry key on the Windows 2008 server, HKLM\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration.

3. Get the certificate templates that are being offered with the following command, certutil.exe -catemplates > c:\bak\catemplates.txt.

4. Remove the Active Directory Certificate Services role on the Windows 2008 server.

5. Install the Active Directory Certificate Services role on the Windows 2012 R2 server. Configure the Certificate Services for the Enterprise and use the backed up private key from the Windows 2008 server.

6. Restore the private key, certificate database and certificate database log on the Windows 2012 server.

7. Edit the .reg file from the Windows 2008 server, and replace the Windows 2008 server name with the Windows 2012 server name. Do not change any Certificate Authority names.

8. Import the .reg file on the Windows 2012 R2 server.

9. Restart the Windows 2012 R2 server and verify functionality. Verify services are started, previously issued certificates are in the database, and even request a new Certificate.

10. Backup the certificate authority database and private key on the Windows 2012 R2 server.

11. Backup the following registry key on the Windows 2012 R2 server, HKLM\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration.

12. Remove the Active Directory Certificate Services role on the Windows 2012 R2 server.

13. Install the Active Directory Certificate Services role on the Windows 2016 server. Configure the Certificate Services for the Enterprise and use the backed up private key from the Windows 2012 R2 server.

14. Restore the private key, certificate database and certificate database log on the Windows 2016 server.

15. Edit the .reg file from the Windows 2012 R2 server, and replace the Windows 2012 R2 server name with the Windows 2016 server name. Do not change any Certificate Authority names.

16. Import the .reg file on the Windows 2016 server.

17. Restart the Windows 2016 server and verify functionality. Verify services are started, previously issued certificates are in the database, and even request a new certificate.