{"id":31759,"date":"2019-10-31T21:42:53","date_gmt":"2019-10-31T18:42:53","guid":{"rendered":"https:\/\/prohoster.info\/blog\/ne-udachnaya-migratsiya-certificate-authority-ca-s-windows-2008r-na-windows-2012-r2\/"},"modified":"2019-10-31T21:42:53","modified_gmt":"2019-10-31T18:42:53","slug":"ne-udachnaya-migratsiya-certificate-authority-ca-s-windows-2008r-na-windows-2012-r2","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/ne-udachnaya-migratsiya-certificate-authority-ca-s-windows-2008r-na-windows-2012-r2","title":{"rendered":"Ne\u00faspe\u0161n\u00e1 migr\u00e1cia Certificate Authority (CA) z Windows 2008 R na Windows 2012 R2","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Dobr\u00fd de\u0148, v\u00e1\u017een\u00fd \u010ditate\u013e,
\n Poviem v\u00e1m o svojej no\u010dnej more, ktor\u00fa som pre\u017eil pri migr\u00e1cii CA z Windows 2008 R2 na Windows 2012 R2. Na internete je ve\u013ea \u010dl\u00e1nkov na t\u00fato t\u00e9mu a \u017eiadne probl\u00e9my by nemali nasta\u0165. <\/p>\n

K svojmu \u013e\u00fatosti \u2014 nie som ve\u013emi Windows administr\u00e1tor, sk\u00f4r *nix admin, ale dostal som \u00falohu migr\u00e1cie CA \u2014 treba to spravi\u0165. <\/p>\n

Pod katom poviem, ako som pre\u0161iel t\u00fdmto procesom a dostal sa k nie \u00faplne \u0161\u0165astn\u00e9mu koncu.
\n<\/a><\/noindex>
\nA tak ideme na to\u2026
\nZ\u00e1kladn\u00e9 \u00fadaje:<\/b>
\nZdroj<\/b> \u2014 Windows 2008 R2 s Root CA
\nCie\u013e<\/b> \u2014 Windows 2012 R2<\/p>\n

Server Windows 2012 R2 som u\u017e mal nain\u0161talovan\u00fd a minim\u00e1lne nastaven\u00fd. <\/p>\n

P\u00f4vodn\u00fd pl\u00e1n bol tak\u00fdto (skr\u00e1ten\u00e9 kroky):<\/b>
\n1) Urob\u00edme z\u00e1lohu CA + Priv\u00e1tneho k\u013e\u00fa\u010da a skop\u00edrujeme ho na spolo\u010dn\u00fa zdie\u013ean\u00fa plochu pre oba po\u010d\u00edta\u010de
\n2) Vyvedieme cie\u013e z dom\u00e9ny a zmen\u00edme IP
\n3) Urob\u00edme snapshot servera
\n4) Zmen\u00edme IP na zdroji
\n5) Prihl\u00e1sime sa na nov\u00fd server Windows 2012 R2 ako administr\u00e1tor \u2014 vlo\u017e\u00edme ho do dom\u00e9ny s rovnak\u00fdm menom a pridel\u00edme star\u00fa IP
\n6) Nain\u0161talujeme rolu Active Directory Certificate Service (CA, CA Web Enrollment, NDES, Online Responder)
\n7) Uvedieme, \u017ee je to Enterprise CA
\n8) Obnov\u00edme CA + Priv\u00e1tny k\u013e\u00fa\u010d zo z\u00e1lohy
\n9) \u0160\u0165astn\u00fd koniec<\/p>\n

S\u00fahlas\u00edte, \u017ee ni\u010d zlo\u017eit\u00e9 to nie je. A tak som sa pustil do realiz\u00e1cie. V skuto\u010dnosti \u017eiadne probl\u00e9my nenastali a v\u0161etko prebehlo hladko\u2026 Slu\u017eba sa spustila, Certifik\u00e1tov\u00e9 \u0161abl\u00f3ny sa objavili a samotn\u00e9 certifik\u00e1ty boli vytvoren\u00e9. Skr\u00e1tka v\u0161etko OK. Preto som i\u0161iel spa\u0165. R\u00e1no nepri\u0161lo \u017eiadne s\u0165a\u017enosti na fungovanie CA, a preto som si myslel, \u017ee v\u0161etko funguje, a pustil som sa do in\u00fdch \u00faloh. Po\u010das ich rie\u0161enia som potreboval certifik\u00e1t. Vytvoril som .csr a pre\u0161iel som na odkaz vm_ca\/certsvc<\/noindex>, aby som podp\u00edsal a z\u00edskal certifik\u00e1t a pr\u00e1ve v tomto bode do\u0161lo k chybe. Bohu\u017eia\u013e, screenshot som si neurobil, ale hovorilo sa o nes\u00falade inform\u00e1ci\u00ed o pou\u017e\u00edvate\u013eoch a \u010fal\u0161\u00edch chyb\u00e1ch. No a sme v tom \u2014 napadlo mi. Za\u010dal som googli\u0165, ale \u017eia\u013e, nena\u0161iel som ni\u010d zrozumite\u013en\u00e9.<\/p>\n

U\u017e ve\u010der sme sa rozhodli odstr\u00e1ni\u0165 CA Windows 2012 R2 a nain\u0161talova\u0165 v\u0161etko znova a tu som urobil chybu, namiesto Enterprise CA som vybral variant Standalone CA (o svojej chybe som sa pravda\u017ee dozvedel nesk\u00f4r). Opakoval som v\u0161etky oper\u00e1cie\u2026 v\u0161etko pre\u0161lo bez ch\u00fdb \u2014 ale pri v\u00fdbere prie\u010dinka Certifik\u00e1tov\u00fdch \u0161abl\u00f3n \u2014 dost\u00e1vam Element not found, hoci ak vyberiem Manage \u2014 \u0161abl\u00f3ny s\u00fa na mieste.
\n Myslel som, \u017ee mi ch\u00fdbaj\u00fa pr\u00e1va pre tento CN=Certificate Templates, preto som pomocou ADSI Edit pridelil Read pre vm_ca$. Re\u0161tartoval som CertSvc a\u2026 v\u00fdsledok: Element not found.
\n Tu ma vzgudulo, lebo je dve hodiny v noci\u2026 a CA nefunguje. Vyp\u00ednam CA Windows 2012R2 a obnovujem VM CA Windows 2008R2 zo snapshotu. Vraciame server do AD (ke\u010f\u017ee pri pokuse o prihl\u00e1senie pod dom\u00e9nov\u00fdm \u00fa\u010dtom sa objav\u00ed chyba vz\u0165ahov medzi serverom<\/a> a AD).
\n No, mysl\u00edm si... teraz u\u017e bude v\u0161etko v poriadku, ale, \u017eia\u013e\u2026 st\u00e1le dost\u00e1vam Error Certificate Templates \u2014 Element not found. Nech\u00e1m v\u0161etko do r\u00e1na \u2014 lebo r\u00e1no je m\u00fadrej\u0161ie ve\u010dera.
\n R\u00e1no som googlil, \u010d\u00edtal r\u00f4zne \u010dl\u00e1nky \u2014 rozhodujem sa na prein\u0161talovanie CA na starom serveri<\/a> v n\u00e1deji, \u017ee vyrie\u0161im probl\u00e9m Element Not Found a vyd\u00e1vanie certifik\u00e1tov cez Web.<\/p>\n

Proces je celkom jednoduch\u00fd:<\/b>
\n1) Odstr\u00e1\u0148te rolu CA
\n2) Re\u0161tartujeme
\n3) \u010cak\u00e1me na dokon\u010denie procesu odstr\u00e1nenia
\n4) Prid\u00e1vame rolu CA (uv\u00e1dzame CA, CA Web Enrollment, NDES, Online Responder)
\n5) Uv\u00e1dzame, \u017ee m\u00e1m Enterprise CA a m\u00e1m s\u00fakromn\u00fd k\u013e\u00fa\u010d
\n6) \u010cak\u00e1me na dokon\u010denie in\u0161tal\u00e1cie a obnovujeme v\u0161etko zo z\u00e1lohy, ktor\u00fa sme vytvorili na za\u010diatku.
\n7) Ako obvykle, v\u0161etko prebehlo na v\u00fdborn\u00fa \u2014 bez ch\u00fdb a slu\u017eba sa spustila.<\/p>\n

So strachom klik\u00e1m na Certificate Templates \u2014 a... dostal som zoznam \u2014 to u\u017e je mal\u00e1 v\u00fdhra. Ost\u00e1va skontrolova\u0165 pr\u00e1cu pre vyd\u00e1vanie certifik\u00e1tov cez Web. Prech\u00e1dzam na odkaz: vm_ca\/certsvc<\/noindex> a klik\u00e1m na Request a Certificate a \u010falej advanced certificate request\u2026 uv\u00e1dzam .csr po\u017eiadavku a dost\u00e1vam prichystan\u00fd certifik\u00e1t. Vydychujem\u2026 Obnovi\u0165 CA sa podarilo.<\/p>\n

V\u00fdvody:<\/b>
\n1) Ur\u010dite robte z\u00e1lohu a snapshot.
\n2) Dokumentujte svoje kroky \u2014 to pom\u00f4\u017ee vr\u00e1ti\u0165 v\u0161etko sp\u00e4\u0165 alebo r\u00fdchlej\u0161ie n\u00e1js\u0165 chybu.<\/p>\n

P.s. Mus\u00edm op\u00e4\u0165 vysk\u00fa\u0161a\u0165 migr\u00e1ciu CA z Windows 2008R na Windows 2012R2.
\n
Zdroj: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0414\u043e\u0431\u0440\u044b\u0439 \u0434\u0435\u043d\u044c \u0443\u0432\u0430\u0436\u0430\u043c\u044b\u0439 \u0447\u0438\u0442\u0430\u0442\u0435\u043b\u044c, \u042f \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0443 \u0412\u0430\u043c \u043e \u0441\u0432\u043e\u0435\u043c \u043a\u043e\u0448\u043c\u0430\u0440\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u044f \u043f\u0435\u0440\u0435\u0436\u0438\u043b \u043c\u0438\u0433\u0440\u0438\u0440\u0443\u044f CA \u0441 Windows 2008R2 \u043d\u0430 Windows 2012 R2. \u0412 \u0438\u043d\u0435\u0442\u0435 \u043e\u0447\u0435\u043d\u044c \u043c\u043d\u043e\u0433\u043e \u0441\u0442\u0430\u0442\u044c\u0439 \u043f\u043e \u044d\u0442\u043e\u043c\u0443 \u043f\u043e\u0432\u043e\u0434\u0443 \u0438 \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u043d\u0435 \u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0431\u044b\u0442\u044c. \u041a \u0441\u0432\u043e\u0435\u043c\u0443 \u0441\u043e\u0436\u0430\u043b\u0435\u043d\u0438\u044e \u2014 \u044f \u043d\u0435 \u043e\u0441\u043e\u0431\u043e Windows Admin, \u044f \u0431\u043e\u043b\u044c\u0448\u0435 *nix \u0430\u0434\u043c\u0438\u043d, \u043d\u043e \u0431\u044b\u043b\u0430 \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u0437\u0430\u0434\u0430\u0447\u0430 \u043c\u0438\u0433\u0440\u0430\u0446\u0438\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31759","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ne\u00faspe\u0161n\u00e1 migr\u00e1cia Certificate Authority (CA) z Windows 2008R na Windows 2012 R2 | ProHoster","description":"Dobr\u00fd de\u0148, v\u00e1\u017een\u00fd \u010ditate\u013e, poviem v\u00e1m o svojej no\u010dnej more, ktor\u00fa som pre\u017eil pri migr\u00e1cii CA z Windows 2008R2 na Windows 2012 R2. Na internete je ve\u013ea \u010dl\u00e1nkov na toto t\u00e9ma a nemali by nasta\u0165 \u017eiadne probl\u00e9my.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/ne-udachnaya-migratsiya-certificate-authority-ca-s-windows-2008r-na-windows-2012-r2","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u0435 \u0443\u0434\u0430\u0447\u043d\u0430\u044f \u043c\u0438\u0433\u0440\u0430\u0446\u0438\u044f Certificate Authority(CA) \u0441 Windows 2008R \u043d\u0430 Windows 2012 R2 | ProHoster","og:description":"\u0414\u043e\u0431\u0440\u044b\u0439 \u0434\u0435\u043d\u044c \u0443\u0432\u0430\u0436\u0430\u043c\u044b\u0439 \u0447\u0438\u0442\u0430\u0442\u0435\u043b\u044c, \u042f \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0443 \u0412\u0430\u043c \u043e \u0441\u0432\u043e\u0435\u043c \u043a\u043e\u0448\u043c\u0430\u0440\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u044f \u043f\u0435\u0440\u0435\u0436\u0438\u043b \u043c\u0438\u0433\u0440\u0438\u0440\u0443\u044f CA \u0441 Windows 2008R2 \u043d\u0430 Windows 2012 R2. \u0412 \u0438\u043d\u0435\u0442\u0435 \u043e\u0447\u0435\u043d\u044c \u043c\u043d\u043e\u0433\u043e \u0441\u0442\u0430\u0442\u044c\u0439 \u043f\u043e \u044d\u0442\u043e\u043c\u0443 \u043f\u043e\u0432\u043e\u0434\u0443 \u0438 \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u043d\u0435 \u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0431\u044b\u0442\u044c.","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/ne-udachnaya-migratsiya-certificate-authority-ca-s-windows-2008r-na-windows-2012-r2","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:42:53+00:00","article:modified_time":"2019-10-31T18:42:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31759","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 21:50:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:11:23","updated":"2026-02-09 21:50:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/31759","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=31759"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/31759\/revisions"}],"predecessor-version":[{"id":160244,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/31759\/revisions\/160244"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=31759"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=31759"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=31759"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}