{"id":884,"date":"2024-03-16T10:43:46","date_gmt":"2024-03-16T14:43:46","guid":{"rendered":"https:\/\/anthonyfontanez.com\/?p=884"},"modified":"2024-03-16T10:43:49","modified_gmt":"2024-03-16T14:43:49","slug":"migrating-an-online-issuing-ca-ocsp","status":"publish","type":"post","link":"https:\/\/anthonyfontanez.com\/index.php\/2024\/03\/16\/migrating-an-online-issuing-ca-ocsp\/","title":{"rendered":"Migrating an Online Issuing CA & OCSP"},"content":{"rendered":"\n

<\/p>\n\n\n\n

This post is mostly sourced from https:\/\/techcommunity.microsoft.com\/t5\/itops-talk-blog\/step-by-step-migrating-active-directory-certificate-service-from\/ba-p\/2328766<\/a>, along with some helpful notes, screenshots, and code samples from my own experience. It’s mostly here for my own documentation purposes.<\/p>\n\n\n\n

Backup the CA<\/h3>\n\n\n
\n
\"\"<\/figure>\n<\/div>\n\n\n

Select backup options<\/p>\n\n\n

\n
\"\"<\/figure>\n<\/div>\n\n\n

Generate and save a secure password<\/p>\n\n\n

\n
\"\"<\/figure>\n<\/div>\n\n\n

Click Finish<\/p>\n\n\n

\n
\"\"<\/figure>\n<\/div>\n\n\n

Export CA Registry Settings<\/h3>\n\n\n
\n
\"\"<\/figure>\n<\/div>\n\n
\n
\"\"<\/figure>\n<\/div>\n\n\n

Copy the backup files to the new server<\/p>\n\n\n

\n
\"\"<\/figure>\n<\/div>\n\n\n

Uninstall ADCS roles and restart the server<\/p>\n\n\n\n

Remove-WindowsFeature -Name ADCS-Web-Enrollment -Confirm:$false\nRemove-WindowsFeature -Name ADCS-Online-Cert -Confirm:$false\nRemove-WindowsFeature -Name ADCS-Cert-Authority -Confirm:$false\nRestart-Computer<\/code><\/pre>\n\n\n\n
Move alternative name (if in use) from old server to new server<\/p>\n\n\n\n
netdom computername OLDCA.ad.domain.tld \/remove PKI.ad.domain.tld<\/code><\/pre>\n\n\n\n
netdom computername NEWCA.ad.domain.tld \/add PKI.ad.domain.tld\nipconfig \/registerdns<\/code><\/pre>\n\n\n\n
Install AD CS Roles on New Server<\/h3>\n\n\n
\n
\"\"<\/figure>\n<\/div>\n\n\n
Configure the CA (remember to log in with Enterprise Admin credentials)<\/p>\n\n\n
\n
\"\"<\/figure>\n<\/div>\n\n
\n
\"\"<\/figure>\n<\/div>\n\n
\n
\"\"<\/figure>\n<\/div>\n\n
\n
\"\"<\/figure>\n<\/div>\n\n
\n
\"\"<\/figure>\n<\/div>\n\n
\n
\"\"<\/figure>\n<\/div>\n\n
\n
\"\"<\/figure>\n<\/div>\n\n
\n
\"\"<\/figure>\n<\/div>\n\n
\n
\"\"<\/figure>\n<\/div>\n\n\n
Restoring the CA Backup<\/h3>\n\n\n\n
Stop the CA service<\/p>\n\n\n\n
Stop-Service -Name CertSvc<\/code><\/pre>\n\n\n\n
Edit the registry backup and update the WebClientCAMachine<\/code> and CAServerName<\/code> values<\/p>\n\n\n
\n
\"\"<\/figure>\n<\/div>\n\n
\n
\"\"<\/figure>\n<\/div>\n\n\n
Restore the CA backup<\/p>\n\n\n\n
\"\"<\/p>\n\n\n
\n
\"\"<\/figure>\n<\/div>\n\n
\n
\"\"<\/figure>\n<\/div>\n\n
\n
\"\"<\/figure>\n<\/div>\n\n\n
Import the registry backup, and restart ADCS again<\/p>\n\n\n\n
reg import .\\CA_Backup.reg\nRestart-Service -Name CertSvc<\/code><\/pre>\n\n\n\n
Unpublish default templates and publish custom templates<\/p>\n\n\n
\n
\"\"<\/figure>\n<\/div>\n\n\n
Enable Directory Browsing for CertEnroll directory in IIS<\/p>\n\n\n
\n
\"\"<\/figure>\n<\/div>\n\n\n
Copy over previous AIA files from old CA (unsure if actually needed, but easy enough to do)<\/p>\n\n\n
\n
\"\"<\/figure>\n<\/div>\n\n\n
Verify the new CDP can be accessed internally and externally via AAD App Proxy<\/p>\n\n\n
\n
\"\"<\/figure>\n<\/div>\n\n\n
Use pkiview.msc to verify CDP\/AIA is valid (note, OCSP will be in an error state until reinstalled)<\/p>\n\n\n
\n
\"\"<\/figure>\n<\/div>\n\n\n
Use certutil from a client to also verify CDP validity<\/p>\n\n\n\n
certutil -url http:\/\/pki.corp.ajf.one\/CertEnroll\/AJF.ONE%20CORP%20SIGNING%20CA.crl<\/code><\/pre>\n\n\n
\n
\"\"<\/figure>\n<\/div>\n\n\n
Reinstalling OCSP<\/h3>\n\n\n
\n
\"\"<\/figure>\n<\/div>\n\n
\n
\"\"<\/figure>\n<\/div>\n\n\n
Reconfiguring OCSP<\/h3>\n\n\n
\n
\"\"<\/figure>\n<\/div>\n\n
\n
\"\"<\/figure>\n<\/div>\n\n
\n
\"\"<\/figure>\n<\/div>\n\n
\n
\"\"<\/figure>\n<\/div>\n\n
\n
\"\"<\/figure>\n<\/div>\n\n
\n
\"\"<\/figure>\n<\/div>\n\n
\n
\"\"<\/figure>\n<\/div>\n\n
\n
\"\"<\/figure>\n<\/div>\n\n\n
Verify OCSP Configuration<\/h3>\n\n\n
\n
\"\"<\/figure>\n<\/div>\n\n\n
If the OCSP application does not appear in IIS, run the following to recreate it<\/p>\n\n\n\n
certutil -vocsproot<\/code><\/pre>\n\n\n\n
Validating everything via pkiview.msc<\/p>\n\n\n
\n
\"\"<\/figure>\n<\/div>\n\n\n
Export a local cert and verify it via OCSP with certutil -url<\/code><\/p>\n\n\n
\n
\"\"<\/figure>\n<\/div>\n\n\n
Congratulations! You’re done!<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"
This post is mostly sourced from https:\/\/techcommunity.microsoft.com\/t5\/itops-talk-blog\/step-by-step-migrating-active-directory-certificate-service-from\/ba-p\/2328766, along with some helpful notes, screenshots, and code samples from my own experience. It’s mostly here for my<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":true,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[6,25],"tags":[2,26],"class_list":["post-884","post","type-post","status-publish","format-standard","hentry","category-active-directory","category-pki","tag-active-directory","tag-pki"],"jetpack_featured_media_url":"","jetpack_likes_enabled":true,"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/anthonyfontanez.com\/index.php\/wp-json\/wp\/v2\/posts\/884","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/anthonyfontanez.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/anthonyfontanez.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/anthonyfontanez.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/anthonyfontanez.com\/index.php\/wp-json\/wp\/v2\/comments?post=884"}],"version-history":[{"count":8,"href":"https:\/\/anthonyfontanez.com\/index.php\/wp-json\/wp\/v2\/posts\/884\/revisions"}],"predecessor-version":[{"id":968,"href":"https:\/\/anthonyfontanez.com\/index.php\/wp-json\/wp\/v2\/posts\/884\/revisions\/968"}],"wp:attachment":[{"href":"https:\/\/anthonyfontanez.com\/index.php\/wp-json\/wp\/v2\/media?parent=884"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/anthonyfontanez.com\/index.php\/wp-json\/wp\/v2\/categories?post=884"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/anthonyfontanez.com\/index.php\/wp-json\/wp\/v2\/tags?post=884"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}