Migrating Certificate Service From Windows Server 2008 R2 to 2019

Video Series on Active Directory Certificate Service with Windows Server 2019:

In this step by step guide, we are going to migrate active directory Certificate Service From Windows Server 2008 R2 to windows server 2019. We want to migrate existing enterprise root 2008 R2 certificate authority to Windows Server 2019.

Follow my blogs:

[Hugomartinez]

You are amazing! thanks for the help. had been decades since I did it and needed a refresher.

[chrismoney]

Thank you- This video is exceptionally well done and accurate. Awesome!

[mohdhasan]

Excellent. One one can explain like you easily with step-step practical lab. Great !

[massimilianogasbarro]

Thanks for your great content MSFT WebCast,

I have a question for you. If am migrating a Certification Authority which is integrated with Active Directory, I know that CA read and write from NTDS.DIT. If I do a checkpoint on Hypervisor, and then I have problem in migration, can I revert back to that checkpoint or will I have problem as CA read on NTDS.DIT old data?

Thank you

[mcsebala]

There are some certificates very old more than 5 years. Those certificates does not required for business use. How to delete the expired and revoked certificates from ADCS.

[robby.kilian]

Very helpful. Just what I was looking for. Thank you.

[karthickvairavel]

Question - Since you changed the CA name on the destination server. you should set the permissions on the "Active directory sites and services" for the AIA and CDP with the new server name ?

[MasQueVencedorEnCristo]

Thx gonna need this soon upgrading production environments .. I may run this in my lab first 😎

[jagadeeshks]

What steps will change, if the server being migrated has its private key stored inside a HSM?

[VJayRana]

How about CRL and AIA information URLs, those are still going to point out to old server name which you uninstalled ADCS role.

[tonskyx]

Have you ever done any PKI Migrations ? If yes do you have 2 tier migration. 1 offline root CA and 2 issuing CA's and 2 web enrollment servers and a AD. These certs are used only for internal purpose.

[itzickmaymon]

hi all your videos are really helpful and professional .do you have video how to Migrating Shared Folder from Server 2008R2 to Server 2019/2022

[richcore]

You can't upgrade from 2008 to 2019 straight tough.

You have to update from 2008 to 2012 before to update the database.

[Good-Enuff-Garage]

Can we do an in place upgrade of 2008 Certificate Authority to 2019 on the same box?

[DreidyMontilla]

Thanks for shared the information we us !!!!

[kingshuksarkar]

Shown method didn't worked for me in two tire CA environment. Could you please provide more details on this

[Артём-кщч]

Hi there! When I'm trying to backup CA from winsrv 2008r2 im getting this message: 'Windows cannot back up one or more private keys because the CSP does not support key export. Do you want to continue and back up only the private keys thac can be exported?".
Maybe somebody could give me advice on what to do with this error and what could be the consequences if you backup only private keys that can be exported? Thanks!

[westcoastelite]

how would this process differ if you have both a Root CA and a Sub CA?

[richardpughiii]

Quick question...Once you move to the new CA Server, will AD automatically update the certs to the machines and say network appliances? Or will that need to be done manually?

[gabrielluizbh]

Should I also change the "WebClientCAMachine" ?