Rashin nasarar ƙaura na Hukumar Takaddun shaida (CA) daga Windows 2008R zuwa Windows 2012 R2

Barka da rana dan uwa mai karatu,
Zan gaya muku game da mafarkin da na shiga ta hanyar ƙaura CA daga Windows 2008R2 zuwa Windows 2012 R2. Akwai labarai da yawa akan intanet game da wannan kuma bai kamata a sami matsala ba.

Don nadama, ni ba ainihin Windows Admin ba ne, Ni ne mai gudanarwa na * nix, amma an saita aikin ƙaura na CA - yana buƙatar a yi.

A ƙasan yanke, zan gaya muku yadda na bi ta wannan tsari kuma na ƙare tare da Ƙarshen Farin Ciki.

Don haka mu tafi...
Bayanan farko:
Source - Windows 2008 R2 tare da Tushen CA
manufa - Windows 2012R2

Na riga an shigar da Windows 2012R2 kuma an daidaita shi kaɗan.

Da farko, shirin aikin ya kasance kamar haka (gajerun ayyuka):
1) Yi Ajiyayyen CA+Private Key da kwafa shi zuwa ga gama gari ga kwamfutoci biyu
2) Cire manufa daga yankin kuma canza IP
3) Yi hoton uwar garken
4) Canza IP a tushen
5) Muna zuwa sabon uwar garken Windows 2012R2 a matsayin mai gudanarwa - shigar da shi cikin yankin da sunan iri ɗaya kuma sanya tsohon IP.
6) Saita Matsayin Sabis na Takaddun Takaddun Bayanan Active (CA, CA Yanar Gizo, NDES, Mai Amsa Kan Layi)
7) Mun nuna cewa wannan shine Enterprise CA
8) Mai da CA + Keɓaɓɓen Key daga madadin
9) Karshen Farin Ciki

Yarda, babu wani abu mai rikitarwa. Kuma na fara aiwatar da shi. A gaskiya ma, babu matsaloli kuma komai ya tafi kamar aikin agogo ... An fara sabis ɗin, Samfuran Takaddun shaida sun bayyana kuma takaddun shaida da kansu sun bayyana. Gabaɗaya, komai yayi kyau. Haka na kwanta. Da safe babu gunaguni game da aikin CA kuma saboda haka na ɗauka cewa duk abin da ke aiki kuma ya ci gaba zuwa wasu ayyuka. A cikin aiwatar da warware su, Ina buƙatar takaddun shaida. Na kirkiro .csr kuma na bi hanyar haɗin vm_ca/certsvcdon sa hannu da karɓar takaddun shaida kuma a wannan matakin an sami kuskure. Abin takaici, ban dauki hoton allo ba, amma ya ce bayanan mai amfani da rashin daidaituwa da wasu kurakurai. To, ga mu nan, na yi tunani. Na fara guggu, amma abin takaici ban sami wani abu mai hankali ba.

Da yamma mun yanke shawarar cire CA Windows 2012R2 kuma shigar da komai sabo, sannan na yi kuskure; maimakon Enterprise CA, na zaɓi zaɓi na Standalone CA (ko da yake na koyi game da kuskurena daga baya). Na sake yin duk ayyukan... komai ya tafi ba tare da kurakurai ba - amma lokacin da na zaɓi babban fayil ɗin Samfuran Takaddun shaida, na sami Element ba a samu ba, kodayake idan na zaɓi Sarrafa, to samfuran suna nan.
Na yi tunanin cewa babu isassun haƙƙoƙi na wannan CN= Takaddun Takaddun Samfura, don haka amfani da ADSI Edit na ba da Karatu don vm_ca$. Na sake kunna CertSvc da...sakamako: Ba a sami wani abu ba.
Sai na ji bakin ciki saboda karfe 2 na safe ne... kuma CA ba ta aiki. Na kashe CA Windows 2012R2 kuma na mayar da VM CA Windows 2008R2 daga hoto. Ina mayar da uwar garken zuwa AD (saboda lokacin da na yi ƙoƙarin shiga tare da asusun yanki, kuskure yana faruwa game da dangantaka tsakanin uwar garken da AD).
To, ina tsammanin... komai zai yi kyau yanzu, amma kash... har yanzu Samfuran Takaddun Shaida iri ɗaya ne - Ba a sami Element ba. Zan bar kome har sai da safe - domin safe ya fi maraice hikima.
Da safe na yi google kuma na karanta labarai daban-daban - Na yanke shawarar sake shigar da CA akan tsohuwar uwar garken a cikin bege na warware matsalar Element Ba a samo ba da bayar da takaddun shaida ta hanyar Yanar gizo.

Tsarin yana da sauƙi:
1) Share rawar CA
2) Yin nauyi
3) Jira tsarin cirewa don kammala
4) Ƙara rawar CA (ƙayyade CA, CA Yanar Gizo, NDES, Mai Amsa Kan Layi)
5) Mun nuna cewa ina da Enterprise CA kuma ina da maɓalli na sirri
6) Muna jiran shigarwa don kammalawa da mayar da komai daga madadin da muka yi a farkon farawa.
7) Kamar yadda ya saba, duk abin yana tafiya tare da bang - babu kurakurai kuma sabis ya fara

Tare da nitsewar zuciya, na danna Samfuran Takaddun shaida - kuma… An ba ni jeri - wannan tuni ƙaramin nasara ce. Ya rage don bincika aikin bayar da takaddun shaida ta hanyar Yanar Gizo. Ina bin hanyar: vm_ca/certsvc kuma danna kan Buƙatar Takaddun shaida sannan buƙatun takardar shedar ci-gaba... Na ƙididdige buƙatar .csr kuma na karɓi takardar shedar da aka shirya. Ina fitar da numfashi ... Yana yiwuwa a mayar da CA.

Ƙarshe:
1) Tabbatar yin madadin da hoto
2) Rubuta ayyukanku - wannan zai taimaka muku dawo da komai ko gano kuskure cikin sauri

Ps Dole ne in gwada ƙaura CA daga Windows 2008R zuwa Windows 2012R2 kuma.

source: www.habr.com