{"id":31759,"date":"2019-10-31T21:42:53","date_gmt":"2019-10-31T18:42:53","guid":{"rendered":"https:\/\/prohoster.info\/blog\/ne-udachnaya-migratsiya-certificate-authority-ca-s-windows-2008r-na-windows-2012-r2\/"},"modified":"2019-10-31T21:42:53","modified_gmt":"2019-10-31T18:42:53","slug":"ne-udachnaya-migratsiya-certificate-authority-ca-s-windows-2008r-na-windows-2012-r2","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/ne-udachnaya-migratsiya-certificate-authority-ca-s-windows-2008r-na-windows-2012-r2","title":{"rendered":"Neuspje\u0161na migracija Certificate Authority (CA) s Windows 2008R na Windows 2012 R2","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Dobar dan, po\u0161tovani \u010ditatelju,
\n Ispri\u010dat \u0107u vam svoju no\u0107nu moru koju sam pre\u017eivio migriraju\u0107i CA s Windows 2008R2 na Windows 2012 R2. Na internetu ima mnogo \u010dlanaka o tome, i problema nije trebalo biti. <\/p>\n

Na svoju \u017ealost \u2014 nisam ba\u0161 Windows administrator, vi\u0161e sam *nix administrator, ali bio je postavljen zadatak migracije CA \u2014 to sam morao u\u010diniti. <\/p>\n

U nastavku \u0107u opisati kako sam pro\u0161ao kroz taj proces i na kraju imao ne ba\u0161 sretan ishod.
\n<\/a><\/noindex>
\nDakle, kre\u0107emo...
\nIzvorni podaci:<\/b>
\nIzvor<\/b> \u2014 Windows 2008 R2 s Root CA
\nCilj<\/b> \u2014 Windows 2012R2<\/p>\n

Windows 2012R2 server ve\u0107 je bio instaliran i minimalno pode\u0161en. <\/p>\n

Izvorni plan djelovanja bio je sljede\u0107i (skra\u0107ene radnje):<\/b>
\n1) Napraviti Backup CA + Privatni klju\u010d i kopirati ga na zajedni\u010dku mre\u017enu mapu za oba ra\u010dunala
\n2) Izvaditi target iz domene i promijeniti IP
\n3) Napraviti snapshot servera
\n4) Promijeniti IP na izvoru
\n5) Prijaviti se na novi server Windows 2012R2 kao admin \u2014 dodati ga u domenu s istim imenom i dodijeliti stari IP
\n6) Instalirati ulogu Active Directory Certificate Service (CA, CA Web Enrollment, NDES, Online Responder)
\n7) Navesti da je ovo Enterprise CA
\n8) Obnoviti CA + Privatni klju\u010d iz backup-a
\n9) Sretan kraj<\/p>\n

Sla\u017eete se da tu nema ni\u0161ta slo\u017eeno. I zapo\u010deo sam s realizacijom. U stvarnosti nije bilo nikakvih problema i sve je pro\u0161lo glatko\u2026 Usluga je pokrenuta, Certificate Templates su se pojavili i sami certifikati su se pojavili. Sve u redu. Zato sam oti\u0161ao na spavanje. Ujutro nije bilo pritu\u017ebi na rad CA, pa sam smatrao da sve funkcionira i pre\u0161ao na druge zadatke. Tijekom rje\u0161avanja tih zadataka trebao sam certifikat. Napravio sam .csr i oti\u0161ao na link vm_ca\/certsvc<\/noindex>, da potpi\u0161em i dobijem certifikat, i na ovoj to\u010dki do\u0161lo je do pogre\u0161ke. Na\u017ealost, nisam napravio snimku zaslona, ali je pisalo o neuskla\u0111enim korisni\u010dkim informacijama i jo\u0161 ne\u010demu. Pomislio sam \u2014 eto u \u010demu je problem. Po\u010deo sam googlati, ali na\u017ealost nisam na\u0161ao ni\u0161ta korisno.<\/p>\n

Ve\u010der prije odlu\u010dili smo izbrisati CA Windows 2012R2 i instalirati sve iznova, i tu sam napravio gre\u0161ku; umjesto Enterprise CA izabrao sam opciju Standalone CA (o svojoj gre\u0161ci saznao sam kasnije). Ponovo sam obavio sve operacije\u2026 sve je pro\u0161lo bez gre\u0161aka \u2014 ali prilikom odabira mape Certificate Templates \u2014 dobijam Element not found, iako ako odaberem Manage \u2014 predlo\u0161ci su na mjestu.
\n Pomislio sam da nema dovoljno prava za CN=Certificate Templates, pa sam putem ADSI Edit dodijelio Read za vm_ca$. Ponovno sam pokrenuo CertSvc i\u2026 rezultat: Element not found.
\n Ovdje sam se osjetio tu\u017eno jer je bilo oko 2 u no\u0107i\u2026 i CA ne radi. Isklju\u010dujem CA Windows 2012R2 i vra\u0107am VM CA Windows 2008R2 iz snapshot-a. Vra\u0107am server u AD (jer prilikom poku\u0161aja prijave pod domenom izlazi gre\u0161ka u me\u0111usobnim odnosima izme\u0111u serverom<\/a> i AD).
\n Pa pomislim\u2026 sada \u0107e sve biti u redu, ali na\u017ealost\u2026 i dalje Certificate Templates \u2014 dobivam Element ne prona\u0111en. Ostavit \u0107u sve do jutra \u2014 jer je jutro pametnije od ve\u010deri.
\n Ujutro sam pretra\u017eivao, \u010ditaju\u0107i razne \u010dlanke \u2014 odlu\u010dio sam se na ponovnu instalaciju CA ve\u0107 na starom serveru<\/a> u nadi da \u0107u rije\u0161iti problem Element Not Found i izdavanju certifikata putem Web-a.<\/p>\n

Proces je prili\u010dno jednostavan:<\/b>
\n1) Bri\u0161emo ulogu CA
\n2) Ponovno pokre\u0107emo
\n3) \u010cekamo zavr\u0161etak procesa brisanja
\n4) Dodajemo ulogu CA (navodimo CA, CA Web Enrollment, NDES, Online Responder)
\n5) Navodimo da imam Enterprise CA i da imam privatni klju\u010d
\n6) \u010cekamo zavr\u0161etak instalacije i vra\u0107amo sve iz sigurnosne kopije koju smo napravili na samom po\u010detku.
\n7) Kao i obi\u010dno, sve prolazi u redu \u2014 bez gre\u0161aka i servis je pokrenut<\/p>\n

S uzbu\u0111enjem kliknem na Certificate Templates \u2014 i... dobio sam popis \u2014 to je ve\u0107 mala pobjeda. Osta\u0107e da provjerim rad izdavanja certifikata putem Web-a. Prolazim kroz poveznicu: vm_ca\/certsvc<\/noindex> i kliknem na Request a Certificate i zatim advanced certificate request\u2026 navodim .csr zahtjev i dobivam gotov certifikat. Uspijevam\u2026 Vra\u0107anje CA uspjelo je.<\/p>\n

Zaklju\u010dci:<\/b>
\n1) Obavezno radite sigurnosnu kopiju i snapshot
\n2) Dokumentirajte svoje radnje \u2014 to \u0107e pomo\u0107i vratiti sve natrag ili br\u017ee prona\u0107i gre\u0161ku<\/p>\n

P.s. Ponovno \u0107u poku\u0161ati migraciju CA s Windows 2008R na Windows 2012R2.
\n
Izvor: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0414\u043e\u0431\u0440\u044b\u0439 \u0434\u0435\u043d\u044c \u0443\u0432\u0430\u0436\u0430\u043c\u044b\u0439 \u0447\u0438\u0442\u0430\u0442\u0435\u043b\u044c, \u042f \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0443 \u0412\u0430\u043c \u043e \u0441\u0432\u043e\u0435\u043c \u043a\u043e\u0448\u043c\u0430\u0440\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u044f \u043f\u0435\u0440\u0435\u0436\u0438\u043b \u043c\u0438\u0433\u0440\u0438\u0440\u0443\u044f CA \u0441 Windows 2008R2 \u043d\u0430 Windows 2012 R2. \u0412 \u0438\u043d\u0435\u0442\u0435 \u043e\u0447\u0435\u043d\u044c \u043c\u043d\u043e\u0433\u043e \u0441\u0442\u0430\u0442\u044c\u0439 \u043f\u043e \u044d\u0442\u043e\u043c\u0443 \u043f\u043e\u0432\u043e\u0434\u0443 \u0438 \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u043d\u0435 \u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0431\u044b\u0442\u044c. \u041a \u0441\u0432\u043e\u0435\u043c\u0443 \u0441\u043e\u0436\u0430\u043b\u0435\u043d\u0438\u044e \u2014 \u044f \u043d\u0435 \u043e\u0441\u043e\u0431\u043e Windows Admin, \u044f \u0431\u043e\u043b\u044c\u0448\u0435 *nix \u0430\u0434\u043c\u0438\u043d, \u043d\u043e \u0431\u044b\u043b\u0430 \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u0437\u0430\u0434\u0430\u0447\u0430 \u043c\u0438\u0433\u0440\u0430\u0446\u0438\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31759","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Neuspje\u0161na migracija Certificate Authority (CA) s Windows 2008R na Windows 2012 R2 | ProHoster","description":"Dobar dan po\u0161tovani \u010ditatelju, ispri\u010dat \u0107u vam o svom no\u0107nom moru koje sam pro\u017eivio migriraju\u0107i CA s Windows 2008R2 na Windows 2012 R2. Na internetu ima puno \u010dlanaka o tome i nije trebalo biti nikakvih problema.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/ne-udachnaya-migratsiya-certificate-authority-ca-s-windows-2008r-na-windows-2012-r2","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u0435 \u0443\u0434\u0430\u0447\u043d\u0430\u044f \u043c\u0438\u0433\u0440\u0430\u0446\u0438\u044f Certificate Authority(CA) \u0441 Windows 2008R \u043d\u0430 Windows 2012 R2 | ProHoster","og:description":"\u0414\u043e\u0431\u0440\u044b\u0439 \u0434\u0435\u043d\u044c \u0443\u0432\u0430\u0436\u0430\u043c\u044b\u0439 \u0447\u0438\u0442\u0430\u0442\u0435\u043b\u044c, \u042f \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0443 \u0412\u0430\u043c \u043e \u0441\u0432\u043e\u0435\u043c \u043a\u043e\u0448\u043c\u0430\u0440\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u044f \u043f\u0435\u0440\u0435\u0436\u0438\u043b \u043c\u0438\u0433\u0440\u0438\u0440\u0443\u044f CA \u0441 Windows 2008R2 \u043d\u0430 Windows 2012 R2. \u0412 \u0438\u043d\u0435\u0442\u0435 \u043e\u0447\u0435\u043d\u044c \u043c\u043d\u043e\u0433\u043e \u0441\u0442\u0430\u0442\u044c\u0439 \u043f\u043e \u044d\u0442\u043e\u043c\u0443 \u043f\u043e\u0432\u043e\u0434\u0443 \u0438 \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u043d\u0435 \u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0431\u044b\u0442\u044c.","og:url":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/ne-udachnaya-migratsiya-certificate-authority-ca-s-windows-2008r-na-windows-2012-r2","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:42:53+00:00","article:modified_time":"2019-10-31T18:42:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31759","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 21:50:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:11:23","updated":"2026-02-09 21:50:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/31759","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=31759"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/31759\/revisions"}],"predecessor-version":[{"id":160244,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/31759\/revisions\/160244"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=31759"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=31759"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=31759"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}