Moving Active directory certificate services authority 

Backup the keys and database on the old server. Save them elsewhere. You can get there from adcs -> actions -> backup.
Make sure you backed the private key!!!!

 

Then back up HKLM\system\currentcontrolset\certsvc\config. You want the whole chunk. Export and save.

 

After those 2 items have been backed up, gracefully uninstall certificate services from the old machine. Reboot TWICE once it's done.

 

On the new machine, install the ADCS role.

After, import the private key.

Stop the certsvc service afterwards with net stop certscv on an elevated commandline

If the machinename differs, find webclientcaname in the reg backup and change it to the new servers fqdn

Merge the registry changes < right click the .reg and select merge>

After this is done, go to adcs console and restore the backups of the DB. Restore/overwrite everything.

Fire up the ADCS service

note, you may have database scheme issues if traversing multiple windows versions. If this happens, it will crash. What needs to be done is an import on an intermediary server. Preferably not domainjoined. Standalone CA mode works fine. Just import. And continue on using the new export for the final server.

This article was updated on April 18, 2024