{"id":31759,"date":"2019-10-31T21:42:53","date_gmt":"2019-10-31T18:42:53","guid":{"rendered":"https:\/\/prohoster.info\/blog\/ne-udachnaya-migratsiya-certificate-authority-ca-s-windows-2008r-na-windows-2012-r2\/"},"modified":"2019-10-31T21:42:53","modified_gmt":"2019-10-31T18:42:53","slug":"ne-udachnaya-migratsiya-certificate-authority-ca-s-windows-2008r-na-windows-2012-r2","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/ne-udachnaya-migratsiya-certificate-authority-ca-s-windows-2008r-na-windows-2012-r2","title":{"rendered":"Ne\u00fasp\u011b\u0161n\u00e1 migrace Certificate Authority (CA) z Windows 2008R na Windows 2012 R2","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Dobr\u00fd den, v\u00e1\u017een\u00fd \u010dten\u00e1\u0159i,
\n Pov\u00edm v\u00e1m o sv\u00e9 no\u010dn\u00ed m\u016f\u0159e, kterou jsem pro\u017eil p\u0159i migraci CA z Windows 2008R2 na Windows 2012 R2. Na internetu je spousta \u010dl\u00e1nk\u016f na toto t\u00e9ma, tak\u017ee by nem\u011bly nastat \u017e\u00e1dn\u00e9 probl\u00e9my. <\/p>\n

Bohu\u017eel, nejsem p\u0159\u00edli\u0161 dobr\u00fd Windows administr\u00e1tor, sp\u00ed\u0161e jsem *nix administr\u00e1tor, ale byl jsem pov\u011b\u0159en \u00fakolem migrace CA \u2014 je t\u0159eba to ud\u011blat. <\/p>\n

Pod \u010dl\u00e1nkem v\u00e1m pov\u00edm, jak jsem pro\u0161el t\u00edmto procesem a ve fin\u00e1le jsem z\u00edskal ne zcela happy end.
\n<\/a><\/noindex>
\nA tak se do toho pust\u00edme\u2026
\nV\u00fdchoz\u00ed \u00fadaje:<\/b>
\nZdroj<\/b> \u2014 Windows 2008 R2 s Root CA
\nC\u00edl<\/b> \u2014 Windows 2012R2<\/p>\n

Server Windows 2012R2 jsem m\u011bl ji\u017e nainstalovan\u00fd a minim\u00e1ln\u011b nakonfigurovan\u00fd. <\/p>\n

P\u016fvodn\u00ed pl\u00e1n \u010dinil n\u00e1sleduj\u00edc\u00ed (zkr\u00e1cen\u00e9 kroky):<\/b>
\n1) Vytvo\u0159\u00edme z\u00e1lohu CA + soukrom\u00e9ho kl\u00ed\u010de a zkop\u00edrujeme ji na sd\u00edlenou slo\u017eku pro oba po\u010d\u00edta\u010de
\n2) Vyjmeme target z dom\u00e9ny a zm\u011bn\u00edme IP
\n3) Vytvo\u0159\u00edme snapshot serveru
\n4) Zm\u011bn\u00edme IP na zdroji
\n5) P\u0159ihl\u00e1s\u00edme se na nov\u00fd server Windows 2012R2 jako administr\u00e1tor \u2014 vlo\u017e\u00edme ho do dom\u00e9ny se stejn\u00fdm n\u00e1zvem a p\u0159i\u0159ad\u00edme starou IP
\n6) Nainstalujeme roli Active Directory Certificate Service (CA, CA Web Enrollment, NDES, Online Responder)
\n7) Uvedeme, \u017ee se jedn\u00e1 o Enterprise CA
\n8) Obnov\u00edme CA + soukrom\u00fd kl\u00ed\u010d z z\u00e1lohy
\n9) Happy End<\/p>\n

Souhlas\u00edte, nen\u00ed na tom nic slo\u017eit\u00e9ho. A tak jsem se pustil do realizace. Ve skute\u010dnosti nebyly \u017e\u00e1dn\u00e9 probl\u00e9my a v\u0161e prob\u00edhalo hladce... Slu\u017eba se spustila, \u0161ablony certifik\u00e1t\u016f se objevily a samotn\u00e9 certifik\u00e1ty tak\u00e9. Celkov\u011b v\u0161e v po\u0159\u00e1dku. Tak jsem \u0161el sp\u00e1t. R\u00e1no jsem nedostal \u017e\u00e1dn\u00e9 st\u00ed\u017enosti na pr\u00e1ci CA, a proto jsem si myslel, \u017ee v\u0161e funguje, a pustil jsem se do dal\u0161\u00edch \u00fakol\u016f. V pr\u016fb\u011bhu jejich \u0159e\u0161en\u00ed jsem pot\u0159eboval certifik\u00e1t. Vytvo\u0159il jsem .csr a \u0161el jsem na odkaz vm_ca\/certsvc<\/noindex>, abych podepsal a z\u00edskal certifik\u00e1t, a pr\u00e1v\u011b na tomto kroku do\u0161lo k chyb\u011b. Bohu\u017eel jsem si neud\u011blal screenshot, ale tam byla zm\u00ednka o nesouladu informac\u00ed o u\u017eivateli a dal\u0161\u00ed chyby. Tak jsem si pomyslel, \u017ee jsme se dostali do probl\u00e9mu. Za\u010dal jsem googlit, ale bohu\u017eel jsem nena\u0161el \u017e\u00e1dn\u00e9 jasn\u00e9 informace.<\/p>\n

U\u017e ve\u010der jsme se rozhodli odstranit CA Windows 2012R2 a nainstalovat v\u0161e znovu, a zde do\u0161lo k chyb\u011b, m\u00edsto Enterprise CA jsem vybral variantu Standalone CA (o sv\u00e9 chyb\u011b jsem se dozv\u011bd\u011bl a\u017e pozd\u011bji). Pro\u0161el jsem v\u0161echny operace znovu... v\u0161e prob\u011bhlo bez chyb \u2014 ale p\u0159i v\u00fdb\u011bru slo\u017eky Certificate Templates dost\u00e1v\u00e1m Element not found, i kdy\u017e pokud vyberu Manage \u2014 \u0161ablony jsou na m\u00edst\u011b.
\n Myslel jsem si, \u017ee chyb\u00ed opr\u00e1vn\u011bn\u00ed pro tento CN=Certificate Templates, a proto jsem pomoc\u00ed ADSI Edit dal Read pro vm_ca$. Restartoval jsem CertSvc a\u2026 v\u00fdsledek: Element not found.
\n C\u00edtil jsem se smutn\u011b, proto\u017ee bylo kolem dvou hodin r\u00e1no... a CA nefungovala. Vyp\u00edn\u00e1m CA Windows 2012R2 a obnovuji VM CA Windows 2008R2 ze snapshotu. Vrac\u00edm server do AD (proto\u017ee p\u0159i pokusu o p\u0159ihl\u00e1\u0161en\u00ed pod dom\u00e9nov\u00fdm \u00fa\u010dtem se objevila chyba vztah\u016f mezi serverem<\/a> a AD).
\n No, \u0159\u00edk\u00e1m si... te\u010f to bude v po\u0159\u00e1dku, ale bohu\u017eel... st\u00e1le mi to \u0159\u00edk\u00e1 Certificate Templates \u2014 dost\u00e1v\u00e1m Element not found. Nech\u00e1m to a\u017e do r\u00e1na \u2014 proto\u017ee r\u00e1no je moud\u0159ej\u0161\u00ed ve\u010dera.
\n R\u00e1no jsem to vygooglil, p\u0159e\u010detl r\u016fzn\u00e9 \u010dl\u00e1nky \u2014 rozhodl jsem se p\u0159einstalovat CA na star\u00e9m serveru<\/a> v nad\u011bji, \u017ee vy\u0159e\u0161\u00edm probl\u00e9m Element Not Found a vyd\u00e1v\u00e1n\u00ed certifik\u00e1t\u016f p\u0159es web.<\/p>\n

Proces je docela jednoduch\u00fd:<\/b>
\n1) Odstran\u00edme roli CA
\n2) Restartujeme
\n3) \u010cek\u00e1me na dokon\u010den\u00ed procesu odstran\u011bn\u00ed
\n4) P\u0159id\u00e1me roli CA (stanov\u00edme CA, CA Web Enrollment, NDES, Online Responder)
\n5) Uvedeme, \u017ee m\u00e1m Enterprise CA a \u017ee m\u00e1m soukrom\u00fd kl\u00ed\u010d
\n6) \u010cek\u00e1me na dokon\u010den\u00ed instalace a obnov\u00edme v\u0161echno ze z\u00e1lohy, kterou jsme ud\u011blali na za\u010d\u00e1tku.
\n7) Jak to b\u00fdv\u00e1, v\u0161e prob\u011bhlo skv\u011ble \u2014 bez chyb a slu\u017eba se spustila<\/p>\n

S bu\u0161\u00edc\u00edm srdcem kliknu na Certificate Templates \u2014 a... uk\u00e1zal se mi seznam \u2014 to u\u017e je mal\u00e1 v\u00edt\u011bzstv\u00ed. Zb\u00fdv\u00e1 ov\u011b\u0159it funk\u010dnost vyd\u00e1v\u00e1n\u00ed certifik\u00e1tu p\u0159es web. Proch\u00e1z\u00edm odkazem: vm_ca\/certsvc<\/noindex> a klik\u00e1m na Request a Certificate a d\u00e1le advanced certificate request\u2026 zad\u00e1v\u00e1m .csr po\u017eadavek a dost\u00e1v\u00e1m hotov\u00fd certifik\u00e1t. Vydechl\u2026 Obnovit CA se povedlo.<\/p>\n

Z\u00e1v\u011bry:<\/b>
\n1) Ur\u010dit\u011b si d\u011blejte z\u00e1lohu a snapshot
\n2) Dokumentujte sv\u00e9 kroky \u2014 to pom\u016f\u017ee vr\u00e1tit v\u0161echno zp\u011bt nebo rychleji naj\u00edt chybu<\/p>\n

P.s. Mus\u00edm znovu vyzkou\u0161et migraci CA z Windows 2008R na Windows 2012R2.
\n
Zdroj: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0414\u043e\u0431\u0440\u044b\u0439 \u0434\u0435\u043d\u044c \u0443\u0432\u0430\u0436\u0430\u043c\u044b\u0439 \u0447\u0438\u0442\u0430\u0442\u0435\u043b\u044c, \u042f \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0443 \u0412\u0430\u043c \u043e \u0441\u0432\u043e\u0435\u043c \u043a\u043e\u0448\u043c\u0430\u0440\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u044f \u043f\u0435\u0440\u0435\u0436\u0438\u043b \u043c\u0438\u0433\u0440\u0438\u0440\u0443\u044f CA \u0441 Windows 2008R2 \u043d\u0430 Windows 2012 R2. \u0412 \u0438\u043d\u0435\u0442\u0435 \u043e\u0447\u0435\u043d\u044c \u043c\u043d\u043e\u0433\u043e \u0441\u0442\u0430\u0442\u044c\u0439 \u043f\u043e \u044d\u0442\u043e\u043c\u0443 \u043f\u043e\u0432\u043e\u0434\u0443 \u0438 \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u043d\u0435 \u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0431\u044b\u0442\u044c. \u041a \u0441\u0432\u043e\u0435\u043c\u0443 \u0441\u043e\u0436\u0430\u043b\u0435\u043d\u0438\u044e \u2014 \u044f \u043d\u0435 \u043e\u0441\u043e\u0431\u043e Windows Admin, \u044f \u0431\u043e\u043b\u044c\u0448\u0435 *nix \u0430\u0434\u043c\u0438\u043d, \u043d\u043e \u0431\u044b\u043b\u0430 \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u0437\u0430\u0434\u0430\u0447\u0430 \u043c\u0438\u0433\u0440\u0430\u0446\u0438\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31759","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Nepoda\u0159en\u00e1 migrace Certificate Authority (CA) z Windows 2008R na Windows 2012 R2 | ProHoster","description":"Dobr\u00fd den, v\u00e1\u017een\u00fd \u010dten\u00e1\u0159i, pov\u00edm v\u00e1m o sv\u00e9 no\u010dn\u00ed m\u016f\u0159e, kterou jsem pro\u017eil p\u0159i migraci CA z Windows 2008R2 na Windows 2012 R2. Na internetu je spousta \u010dl\u00e1nk\u016f k tomuto t\u00e9matu a nem\u011blo by b\u00fdt \u017e\u00e1dn\u00e9 probl\u00e9my.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/ne-udachnaya-migratsiya-certificate-authority-ca-s-windows-2008r-na-windows-2012-r2","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u0435 \u0443\u0434\u0430\u0447\u043d\u0430\u044f \u043c\u0438\u0433\u0440\u0430\u0446\u0438\u044f Certificate Authority(CA) \u0441 Windows 2008R \u043d\u0430 Windows 2012 R2 | ProHoster","og:description":"\u0414\u043e\u0431\u0440\u044b\u0439 \u0434\u0435\u043d\u044c \u0443\u0432\u0430\u0436\u0430\u043c\u044b\u0439 \u0447\u0438\u0442\u0430\u0442\u0435\u043b\u044c, \u042f \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0443 \u0412\u0430\u043c \u043e \u0441\u0432\u043e\u0435\u043c \u043a\u043e\u0448\u043c\u0430\u0440\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u044f \u043f\u0435\u0440\u0435\u0436\u0438\u043b \u043c\u0438\u0433\u0440\u0438\u0440\u0443\u044f CA \u0441 Windows 2008R2 \u043d\u0430 Windows 2012 R2. \u0412 \u0438\u043d\u0435\u0442\u0435 \u043e\u0447\u0435\u043d\u044c \u043c\u043d\u043e\u0433\u043e \u0441\u0442\u0430\u0442\u044c\u0439 \u043f\u043e \u044d\u0442\u043e\u043c\u0443 \u043f\u043e\u0432\u043e\u0434\u0443 \u0438 \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u043d\u0435 \u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0431\u044b\u0442\u044c.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/ne-udachnaya-migratsiya-certificate-authority-ca-s-windows-2008r-na-windows-2012-r2","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:42:53+00:00","article:modified_time":"2019-10-31T18:42:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31759","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 21:50:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:11:23","updated":"2026-02-09 21:50:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/31759","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=31759"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/31759\/revisions"}],"predecessor-version":[{"id":160244,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/31759\/revisions\/160244"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=31759"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=31759"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=31759"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}