{"id":31759,"date":"2019-10-31T21:42:53","date_gmt":"2019-10-31T18:42:53","guid":{"rendered":"https:\/\/prohoster.info\/blog\/ne-udachnaya-migratsiya-certificate-authority-ca-s-windows-2008r-na-windows-2012-r2\/"},"modified":"2019-10-31T21:42:53","modified_gmt":"2019-10-31T18:42:53","slug":"ne-udachnaya-migratsiya-certificate-authority-ca-s-windows-2008r-na-windows-2012-r2","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/ne-udachnaya-migratsiya-certificate-authority-ca-s-windows-2008r-na-windows-2012-r2","title":{"rendered":"Unsuccessful migration of Certificate Authority (CA) from Windows 2008R to Windows 2012 R2","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Good day, dear reader,
\n I will tell you about my nightmare that I experienced while migrating CA from Windows 2008R2 to Windows 2012R2. There are a lot of articles on this topic online, and there shouldn\u2019t have been any problems. <\/p>\n

Unfortunately, I am not much of a Windows admin; I am more of a *nix admin, but I was tasked with the migration of CA \u2014 it had to be done. <\/p>\n

Below, I will describe how I went through this process and ultimately did not achieve a Happy End.
\n<\/a><\/noindex>
\nSo let\u2019s get started\u2026
\nInput data:<\/b>
\nSource<\/b> \u2014 Windows 2008 R2 with Root CA
\nTarget<\/b> \u2014 Windows 2012R2<\/p>\n

I already had Windows 2012R2 server installed and minimally configured. <\/p>\n

Initially, the plan of action was as follows (shortened steps):<\/b>
\n1) Make a Backup of CA + Private Key and copy it to a shared directory for both computers
\n2) Remove the target from the domain and change its IP
\n3) Make a server snapshot
\n4) Change the IP on the source
\n5) Log into the new Windows 2012R2 server as an admin \u2014 add it to the domain with the same name and assign the old IP
\n6) Install the Active Directory Certificate Service role (CA, CA Web Enrollment, NDES, Online Responder)
\n7) Specify that this is an Enterprise CA
\n8) Restore CA + Private Key from the backup
\n9) Happy End<\/p>\n

Agree, there\u2019s nothing complicated here. I proceeded with the implementation. In fact, there were no issues, and everything went smoothly\u2026 The service started, Certificate Templates appeared, and the certificates themselves were present. Everything was fine. So I went to sleep. In the morning, there were no complaints about the CA operation, so I assumed everything was working and moved on to other tasks. While addressing these tasks, I needed a certificate. I created a .csr and went to the link vm_ca\/certsrv<\/noindex>, to sign and obtain the certificate, and it was at this stage that the error occurred. Unfortunately, I didn't take a screenshot, but it mentioned a mismatch in user information and some other errors. That's when I realized we were in trouble. I started googling, but unfortunately couldn't find anything clear.<\/p>\n

By evening, we decided to remove CA Windows 2012R2 and reinstall everything, and here I made a mistake: instead of choosing Enterprise CA, I selected the Standalone CA option (I learned about my mistake later). I went through all the operations again\u2026 everything went without errors \u2014 but when selecting the Certificate Templates folder, I got an Element not found error, although if I chose Manage, the templates were there.
\n I thought that the rights for the CN=Certificate Templates might be insufficient, so I used ADSI Edit to grant Read access to vm_ca$. I restarted CertSvc and\u2026 the result: Element not found.
\n I felt gloomy here because it was around 2 AM... and the CA is not working. I am shutting down the CA on Windows 2012R2 and restoring the CA VM on Windows 2008R2 from a snapshot. I am returning the server to the AD (since trying to log in with a domain account gives a trust relationship error with AD). proxy server<\/a> and AD).
\n Well, I think... everything should be okay now, but alas\u2026 the Certificate Templates still show Element not found. I'll leave everything until morning \u2014 because morning is wiser than evening.
\n In the morning, I googled, reading various articles \u2014 and decide to reinstall the CA on the old one server<\/a> hoping to solve the Element Not Found issue and to issue certificates via Web.<\/p>\n

The process is quite simple:<\/b>
\n1) Remove the CA role
\n2) Reboot
\n3) Wait for the uninstallation process to finish
\n4) Add the CA role (specifying CA, CA Web Enrollment, NDES, Online Responder)
\n5) Specify that I have an Enterprise CA and I have a private key
\n6) Wait for the installation to finish and restore everything from the backup we made at the very beginning.
\n7) As usual, everything goes smoothly \u2014 without errors and the service started.<\/p>\n

With bated breath, I click on the Certificate Templates \u2014 and\u2026 a list was generated \u2014 that's already a small victory. The next step is to check the certificate issuance via the Web. I go to the link: vm_ca\/certsrv<\/noindex> and click on Request a Certificate and then advanced certificate request\u2026 I enter the .csr request and receive the finished certificate. I breathe out\u2026 Restoring the CA worked.<\/p>\n

Conclusions:<\/b>
\n1) Always make a backup and snapshot
\n2) Document your actions \u2014 it will help to restore everything or find the error faster<\/p>\n

P.S. I will have to try the CA migration from Windows 2008R to Windows 2012R2 again.
\n
Source: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0414\u043e\u0431\u0440\u044b\u0439 \u0434\u0435\u043d\u044c \u0443\u0432\u0430\u0436\u0430\u043c\u044b\u0439 \u0447\u0438\u0442\u0430\u0442\u0435\u043b\u044c, \u042f \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0443 \u0412\u0430\u043c \u043e \u0441\u0432\u043e\u0435\u043c \u043a\u043e\u0448\u043c\u0430\u0440\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u044f \u043f\u0435\u0440\u0435\u0436\u0438\u043b \u043c\u0438\u0433\u0440\u0438\u0440\u0443\u044f CA \u0441 Windows 2008R2 \u043d\u0430 Windows 2012 R2. \u0412 \u0438\u043d\u0435\u0442\u0435 \u043e\u0447\u0435\u043d\u044c \u043c\u043d\u043e\u0433\u043e \u0441\u0442\u0430\u0442\u044c\u0439 \u043f\u043e \u044d\u0442\u043e\u043c\u0443 \u043f\u043e\u0432\u043e\u0434\u0443 \u0438 \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u043d\u0435 \u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0431\u044b\u0442\u044c. \u041a \u0441\u0432\u043e\u0435\u043c\u0443 \u0441\u043e\u0436\u0430\u043b\u0435\u043d\u0438\u044e \u2014 \u044f \u043d\u0435 \u043e\u0441\u043e\u0431\u043e Windows Admin, \u044f \u0431\u043e\u043b\u044c\u0448\u0435 *nix \u0430\u0434\u043c\u0438\u043d, \u043d\u043e \u0431\u044b\u043b\u0430 \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u0437\u0430\u0434\u0430\u0447\u0430 \u043c\u0438\u0433\u0440\u0430\u0446\u0438\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31759","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Unsuccessful migration of Certificate Authority (CA) from Windows 2008R to Windows 2012 R2 | ProHoster","description":"Good day, dear reader, I will tell you about my nightmare that I experienced when migrating the CA from Windows 2008R2 to Windows 2012 R2. There are many articles about this on the internet, and there shouldn't have been any problems.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/ne-udachnaya-migratsiya-certificate-authority-ca-s-windows-2008r-na-windows-2012-r2","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u0435 \u0443\u0434\u0430\u0447\u043d\u0430\u044f \u043c\u0438\u0433\u0440\u0430\u0446\u0438\u044f Certificate Authority(CA) \u0441 Windows 2008R \u043d\u0430 Windows 2012 R2 | ProHoster","og:description":"\u0414\u043e\u0431\u0440\u044b\u0439 \u0434\u0435\u043d\u044c \u0443\u0432\u0430\u0436\u0430\u043c\u044b\u0439 \u0447\u0438\u0442\u0430\u0442\u0435\u043b\u044c, \u042f \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0443 \u0412\u0430\u043c \u043e \u0441\u0432\u043e\u0435\u043c \u043a\u043e\u0448\u043c\u0430\u0440\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u044f \u043f\u0435\u0440\u0435\u0436\u0438\u043b \u043c\u0438\u0433\u0440\u0438\u0440\u0443\u044f CA \u0441 Windows 2008R2 \u043d\u0430 Windows 2012 R2. \u0412 \u0438\u043d\u0435\u0442\u0435 \u043e\u0447\u0435\u043d\u044c \u043c\u043d\u043e\u0433\u043e \u0441\u0442\u0430\u0442\u044c\u0439 \u043f\u043e \u044d\u0442\u043e\u043c\u0443 \u043f\u043e\u0432\u043e\u0434\u0443 \u0438 \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u043d\u0435 \u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0431\u044b\u0442\u044c.","og:url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/ne-udachnaya-migratsiya-certificate-authority-ca-s-windows-2008r-na-windows-2012-r2","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:42:53+00:00","article:modified_time":"2019-10-31T18:42:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31759","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 21:50:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:11:23","updated":"2026-02-09 21:50:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/31759","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=31759"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/31759\/revisions"}],"predecessor-version":[{"id":160244,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/31759\/revisions\/160244"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=31759"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=31759"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=31759"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}