Safe PKI Issuing CA OS Migration (2019 to 2022): Backup/Restore Strategy Without Deleting Old CA First

Question

Safe PKI Issuing CA OS Migration (2019 to 2022): Backup/Restore Strategy Without Deleting Old CA First

Sreeram Raju 40

Hi Everyone,

I am planning an in-place upgrade/migration of an Active Directory-Integrated Enterprise Issuing CA running on Windows Server 2019 to a new Windows Server 2022 virtual machine.

Key Requirements & Constraints:

Quick Rollback: I want to preserve the existing 2019 CA server configuration completely intact during the migration. If the restore on the Server 2022 instance fails or encounters issues, I need to be able to immediately fail back to the Server 2019 CA without extended downtime.
Side-by-Side Validation: Because this is an Enterprise CA, both the Server Name and the CA Name need to remain identical for existing CRL/AIA distributions and certificate template issuance to function seamlessly.

If I build the new Server 2022 machine and restore the CA database/keys using the same CA name while keeping the Server 2019 CA offline (or uninstalled), there is a risk of naming/AD object conflicts if the Server 2019 CA role isn't cleanly uninstalled first. However, if I completely uninstall AD CS from the Server 2019 node first, my safety net for an instant rollback is gone.

Please guide me to do a migration without deleting the OLD CA, so that I can do a side by side comparison during the migration.

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Steven Nguyen (WICLOUD CORPORATION) 415 Microsoft External Staff Moderator

Hi Sreeram Raju,

To meet your requirements of maintaining the same Hostname/CA Name for CRL/AIA continuity, while keeping the existing CA intact for a rollback, I have compiled the following step-by-step action plan.

Please review the migration phases below:

Phase 1: Pre-Migration Backup (On the existing Server 2019 CA)

Note: We will not uninstall the AD CS role. We are only taking a full backup.

Create a new staging folder at C:\Temp\CABackup.
Document Certificate Templates: Open certsrv.msc -> Right-click Certificate Templates -> Export list -> Save to the backup folder.
(Note: Certificate Templates are stored in Active Directory, not the CA backup. Please take screenshots of the full templates list so we can manually verify them on the new server later).
Backup CA Database & Keys:
1. In certsrv.msc, right-click your CA -> All Tasks -> Back up CA.
2. Select both "Private key and CA certificate" and "Certificate database and logs".
3. Save it to your backup folder.
4. Set a strong password for the private key file. (Critical: Please ensure this password is documented securely, as the backup cannot be restored without it).
5. Verify that the database backup contains all 3 required folders.
Backup CA Registry: Open Registry Editor (regedit) -> Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration -> Right-click Configuration -> Export -> Save the .reg file to your backup folder.
Backup PKI View: Open pkiview.msc -> Right-click your Sub CA -> Export list -> Save to the backup folder.
Backup Physical CRLs (Optional but recommended): Copy the entire contents of C:\Windows\System32\CertSrv\CertEnroll to your backup folder.
Safely copy the entire C:\Temp\CABackup folder to a network share or directly to the new Server 2022 VM.

Phase 2: Isolate the Old CA & Prepare Active Directory

Shutdown the Windows Server 2019 CA completely. Do NOT uninstall any roles.
Log on to a Domain Controller with Domain Admin privileges.
Open Active Directory Users and Computers (dsa.msc).
Locate the Computer Object of the CA server.
Right-click the Computer Object and select Reset Account. (Do NOT delete the object).

Phase 3: Deploy the New CA (On Windows Server 2022)

Power on the new Windows Server 2022 VM.
Open sysdm.cpl and rename this server to be identical to your old Server 2019 CA hostname.
Join the server to the domain using a Domain Admin account and restart. (The new server will take over the reset AD computer account).
Once rebooted, open Server Manager and install the Active Directory Certificate Services (AD CS) role. Do not configure it yet.

Phase 4: Restore CA Configuration

Restore Registry: Locate the .reg file in your backup folder, right-click it, and select Merge. (Ensure that the drive letters on the 2022 server match the 2019 server—e.g., if the DB was on the D:\ drive previously, it must be on the D:\ drive now).
Restore Database & Keys:
1. Open certsrv.msc (it may show the service is stopped).
2. Right-click the CA node -> All Tasks -> Restore CA.
3. Select both "Private key and CA certificate" and "Certificate database and logs".
4. Point the wizard to your backup folder, select the .p12 file, and enter the password you set in Phase 1.
Restart the CA Service: Once the wizard completes, start the Active Directory Certificate Services service.
Validation: Open pkiview.msc to check the health of the CA and CRL distribution points, and ensure the Certificate Templates populate correctly based on your screenshots.

Rollback Procedure

If the Server 2022 CA encounters issues during validation and you need to abort the migration, perform these steps to revert to the 2019 CA:

Shutdown the Server 2022 VM.
On a Domain Controller, open ADUC, right-click the CA's Computer Object, and select Reset Account again.
Power on the old Server 2019 CA.
Open an elevated PowerShell prompt on the 2019 CA and run:
1. Test-ComputerSecureChannel -Repair -Credential (Get-Credential)
Once the command returns True, restart the 2019 server. This will bring the original CA back online to its pre-migration state.

=========================

If this helps resolve your problem, please consider hitting "Accept Answer" so other users facing this failure can easily find the solution!

Sreeram Raju 40 Reputation points

2026-07-28T09:14:32.81+00:00
Hello Steven,

Greetings, Have a nice day,

Thanks for the step-by-step action plan, However my AD team is not agreeing to perform a Account reset on the computer object. They say that performing a reset to the computer object is similar to deleting the object in AD, The chances of recovering it is mearly impossible.

Do we have an alternate solution, rather than account reset. Can you please suggest me how to proceed further.

Phase 2. 5. Right-click the Computer Object and select Reset Account. (Do NOT delete the object).
Steven Nguyen (WICLOUD CORPORATION) 415 Reputation points Microsoft External Staff Moderator

2026-07-29T01:15:55.3566667+00:00
Hi Sreeram,

Thank you for the update.

In that case, we can proceed without resetting the computer account. Please follow the same migration plan, but skip the "Reset Account" step.

The recommended approach would be:

Backup the CA on the Windows Server 2019 system.

Shut down the old CA server and keep it offline for rollback purposes.

Rename the new Windows Server 2022 server to the same hostname.

Join it to the domain using your AD team's preferred method.

Restore the CA database, private key, and configuration.

Perform validation and testing.

If any issues are encountered, simply power off the 2022 server and bring the original 2019 CA server back online.

Hopefully this approach works for your environment.
Sreeram Raju 40 Reputation points

2026-07-29T03:46:15.5333333+00:00

Thanks for the update steven, One quick clarification: if we restore the CA backup without decommissioning the original one first, won't Active Directory flag that a CA with the exact same name already exists and prevent us from proceeding? Could you please advise on how to handle this?"
Steven Nguyen (WICLOUD CORPORATION) 415 Reputation points Microsoft External Staff Moderator

2026-07-29T04:03:26.12+00:00

Hi Sreeram,

The important requirement is that the old CA and the new CA must not be online at the same time once the CA identity has been restored to the new server.

The original Windows Server 2019 CA should be completely powered off before restoring the CA backup to the Windows Server 2022 server. The old server is only being retained offline as a rollback option.

In this scenario, Active Directory should not see two active CAs operating with the same identity simultaneously, since only one CA will be online at any given time.

If rollback is required, simply power off the 2022 server first and then bring the original 2019 CA back online.

Thank you.
Sreeram Raju 40 Reputation points

2026-07-29T04:44:35.2066667+00:00

Thanks for the update :)
Steven Nguyen (WICLOUD CORPORATION) 415 Reputation points Microsoft External Staff Moderator

2026-07-29T04:48:24.8066667+00:00

If it could help you with your problem, please consider hitting "Accept Answer" on the main answer so other users could have a reference.

Hope you have a great day!
Sreeram Raju 40 Reputation points

2026-08-03T11:49:34.3933333+00:00

Copilot said:

Hello Steven,

I have a follow-up question regarding the migration approach.

Our AD team has pointed out that each machine has its own unique SID, GUID, and other Active Directory-related attributes. Given these dependencies, renaming the new CA server to match the existing CA hostname without first decommissioning the old CA appears to be extremely challenging, if not impractical.

Could you please advise on the recommended approach in this scenario?

Additionally, I am confident that I will be able to publish the CRLs to the remote HTTP CRL distribution point. However, if the new CA is not assigned the same hostname as the existing CA, how would the publication of CRLs to Active Directory (LDAP CDP) be handled? Specifically, how can the CA publish the CRLs to LDAP while maintaining continuity for existing certificate validation processes?

I would appreciate any guidance or best practices you can share.
Steven Nguyen (WICLOUD CORPORATION) 415 Reputation points Microsoft External Staff Moderator

2026-08-04T00:16:06.7266667+00:00

Hi Sreeram,

The recommended Microsoft approach is to migrate the CA to a server with a completely NEW hostname.

Microsoft fully supports this. The underlying OS hostname will change, but during the restoration process, the CA Name (Common Name) and the Private Key will remain exactly the same. (Note: Even with a different hostname, you must stop the Certificate Service on the old CA before activating the new one)

Because the new server has a different hostname, it will naturally try to publish CRLs to a new container in Active Directory. However, your existing issued certificates are hardcoded to look for the CRL in the old CA's LDAP path (CN=<OldServerHostname>...).

To maintain validation continuity, you do not change the existing certificates. Instead, you configure the new CA to publish its CRLs directly into the old CA's container in Active Directory. Here is the exact procedure to achieve this:

1. Grant Active Directory Permissions

By default, a CA computer object only has write access to its own container in AD. You must grant the new server permission to write to the old server's container.

Open ADSI Edit and connect to the Configuration partition.

Navigate to: CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=...

Right-click the container named after your OLD CA's Hostname and select Properties -> Security.

Add the NEW CA's Computer Account and grant it Full Control.

2. Modify the LDAP Extension on the New CA

On the new CA, open the CA Properties and go to the Extensions tab. Select the CRL Distribution Point (CDP).

By default, the LDAP path uses the <ServerShortName> variable (represented as %3 in the background). You must remove this dynamic variable and manually hardcode the old CA's hostname into the string.

Default format: ldap:///CN=<CRLNameSuffix>,CN=%3,CN=CDP...

Modified format: ldap:///CN=<CRLNameSuffix>,CN=YOUR_OLD_CA_HOSTNAME,CN=CDP...

3. Publish and Verify

Apply the changes, restart the Active Directory Certificate Services (CertSvc), and force a new CRL publication by running certutil -crl in an elevated command prompt.

The new CA will authenticate and inject the updated CRL into the old CA's Active Directory object.

Safe PKI Issuing CA OS Migration (2019 to 2022): Backup/Restore Strategy Without Deleting Old CA First

Copilot said:

0 additional answers

Your answer