I'm planning to move an Active Directory Certificate Services (AD CS) installation from a Server 2016 VM to a new Server 2022 VM. A new-server migration seems preferable to an in-place upgrade, but I'm not very experienced with AD CS and want to avoid breaking existing certificates or trust relationships.
My current plan is to back up the CA, copy the backup to a network location, shut down the old server, reset or reuse its computer account, build a new Server 2022 machine with the same name and IP address, install the AD CS role, and restore the CA configuration and database. Is there anything important missing from that process?
I also discovered that the CA is installed on the same Server 2016 machine as a domain controller. Can the CA be migrated to a separate server while preserving existing certificates, trusts, and references to the old CA or domain-controller name?
3 Answers
An in-place upgrade can work too. One reasonable approach is to take a verified snapshot or full backup, perform the upgrade, test certificate issuance and revocation, and roll back if necessary. That said, separating the CA from the domain controller is a good opportunity to use a fresh server, especially since the current combined setup was inherited.
Don’t overlook CRL and AIA publication. After the move, verify that the certificate revocation lists are still being generated and copied to every expected HTTP or file location. If IIS on the old machine hosted the CRL, you may need to recreate that configuration or move the files and publication process. The CA console alone may look healthy while clients are unable to retrieve a current CRL.
The PKIView console is useful for checking CA health, CRL expiration, and whether all configured publication locations are reachable after the migration.
The migration approach is generally straightforward if you follow the proper AD CS backup and restore procedure. Make sure you back up the CA database, private key, CA registry settings, and the certificate templates or configuration details you need to reproduce. The replacement server must use the same CA name, and the CA identity needs to be restored rather than creating a brand-new CA. Keep the old server offline during the cutover so you don’t accidentally run two systems with the same CA identity.
The CA is currently installed directly on the domain controller, which is why I’m leaning toward migrating it to another server instead of upgrading that machine in place. My main concern is keeping existing certificates and trust relationships working.