CA Windows Server upgrades

Posted by evil-scholar@reddit | sysadmin | View on Reddit | 6 comments

Any guidance on upgrading CA servers? I have two A servers, an offline root and and issuing CA that’s online. They are both Windows Server 2016. I’d like to get them on a newer version of Windows. Is there a method to stand up new servers and migrate the CA database over?

Reply to Post

6 Comments

[-]

RubyJohnsn@reddit

Build new 2025 boxes, back up the CA DB + keys with certutil -backupDB, restore on the fresh issuing CA, then simply power down the old ones - no in-place upgrade roulette, and your CRL stays valid the whole time.

[-]

evil-scholar@reddit (OP)

So basically it’s back up the DB, remove the old server from AD, restore the backed up DB to a server with the same name?

[-]

Beefcrustycurtains@reddit

Microsoft has the process all documented as well: [https://learn.microsoft.com/en-us/windows-server/identity/ad-cs/migrate-certification-authority?tabs=server-manager](https://learn.microsoft.com/en-us/windows-server/identity/ad-cs/migrate-certification-authority?tabs=server-manager) Definitely don't attempt the inplace upgrade on a CA.

[-]

Stonewalled9999@reddit

of come one our MSP did it and said it was no problem. they also fucked it up and wanted to bill 25 hours to fix. We pushed back on it

[-]

MickCollins@reddit

That would be something to pass to the Legal department if you have one. "So you fucked something and you want me to pay you to unfuck it?"

[-]

scotterdoos@reddit

YMMV, but I upgrade both my offline root and subordinate CA to Server 2022 recently. IPU is supported, but as always, make sure you have backups before you begin. I took the offline root from 2012 R2 to 2019 to 2022 in short order. The subordinate had already recently been rebuilt on Server 2019 and was quick and easy to IPU to 2022. https://learn.microsoft.com/en-us/windows-server/get-started/upgrade-migrate-roles-features