{"id":31759,"date":"2019-10-31T21:42:53","date_gmt":"2019-10-31T18:42:53","guid":{"rendered":"https:\/\/prohoster.info\/blog\/ne-udachnaya-migratsiya-certificate-authority-ca-s-windows-2008r-na-windows-2012-r2\/"},"modified":"2019-10-31T21:42:53","modified_gmt":"2019-10-31T18:42:53","slug":"ne-udachnaya-migratsiya-certificate-authority-ca-s-windows-2008r-na-windows-2012-r2","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/ne-udachnaya-migratsiya-certificate-authority-ca-s-windows-2008r-na-windows-2012-r2","title":{"rendered":"Misslyckad migrering av Certificate Authority (CA) fr\u00e5n Windows 2008R till Windows 2012 R2","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

God dag, k\u00e4ra l\u00e4sare,
\n Jag kommer att ber\u00e4tta f\u00f6r dig om min mardr\u00f6m som jag upplevde n\u00e4r jag migrerade CA fr\u00e5n Windows 2008R2 till Windows 2012 R2. Det finns massor av artiklar om detta p\u00e5 n\u00e4tet och det borde inte ha uppst\u00e5tt n\u00e5gra problem. <\/p>\n

Tyv\u00e4rr \u00e4r jag inte s\u00e4rskilt bra p\u00e5 Windows, jag \u00e4r mer av en *nix-administrat\u00f6r, men jag fick i uppdrag att migrera CA \u2013 det beh\u00f6vde g\u00f6ras. <\/p>\n

Under rubriken kommer jag att ber\u00e4tta hur jag genomf\u00f6rde denna process och till slut fick ett inte helt lyckligt slut.
\n<\/a><\/noindex>
\nS\u00e5, l\u00e5t oss b\u00f6rja\u2026
\nUtg\u00e5ngsdatan:<\/b>
\nK\u00e4lla<\/b> \u2014 Windows 2008 R2 med Root CA
\nM\u00e5l<\/b> \u2014 Windows 2012R2<\/p>\n

Windows 2012R2-servern var redan installerad och minimalt konfigurerad. <\/p>\n

Den ursprungliga handlingsplanen var f\u00f6ljande (f\u00f6rkortade \u00e5tg\u00e4rder):<\/b>
\n1) G\u00f6r backup av CA + Private Key och kopiera den till en delad mapp f\u00f6r b\u00e5da datorerna
\n2) Ta bort m\u00e5let fr\u00e5n dom\u00e4nen och \u00e4ndra IP
\n3) Ta en snapshot av servern
\n4) \u00c4ndra IP p\u00e5 k\u00e4llan
\n5) Logga in p\u00e5 den nya Windows 2012R2-servern som administrat\u00f6r \u2013 l\u00e4gg till den i dom\u00e4nen med samma namn och tilldela gammal IP
\n6) Installera rollen Active Directory Certificate Service (CA, CA Web Enrollment, NDES, Online Responder)
\n7) Ange att detta \u00e4r en Enterprise CA
\n8) \u00c5terst\u00e4ll CA + Private Key fr\u00e5n backupen
\n9) Lyckligt slut<\/p>\n

H\u00e5ller du med om att det inte var s\u00e5 sv\u00e5rt? Jag b\u00f6rjade genomf\u00f6ra det. Egentligen fanns det inga problem och allt gick som smort\u2026 Tj\u00e4nsten startade, Certifikatmallar d\u00f6k upp och certifikaten fanns. Allt var okej. D\u00e4rf\u00f6r gick jag och lade mig. P\u00e5 morgonen kom det inga klagom\u00e5l p\u00e5 att CA inte fungerade och d\u00e4rf\u00f6r trodde jag att allt fungerade och gick vidare med andra uppgifter. Under processen beh\u00f6vde jag ett certifikat. Jag skapade en .csr och gick via l\u00e4nken vm_ca\/certsvc<\/noindex>, f\u00f6r att signera och f\u00e5 certifikatet och just i det h\u00e4r skedet uppstod ett fel. Tyv\u00e4rr tog jag ingen sk\u00e4rmdump, men det stod n\u00e5got om mismatch user information och andra fel. Tanken slog mig: nu har vi verkligen hamnat i trubbel. Jag b\u00f6rjade googla, men tyv\u00e4rr hittade jag inget konkret.<\/p>\n

Redan p\u00e5 kv\u00e4llen best\u00e4mde vi oss f\u00f6r att ta bort CA Windows 2012R2 och g\u00f6ra om allt, och h\u00e4r gjorde jag ett misstag, ist\u00e4llet f\u00f6r Enterprise CA valde jag alternativet Standalone CA (jag fick reda p\u00e5 mitt misstag senare). Jag genomf\u00f6rde alla steg igen\u2026 allt gick utan fel \u2013 men n\u00e4r jag valde mappen Certificate Templates \u2013 fick jag Element not found, \u00e4ven om jag kunde v\u00e4lja Manage \u2013 s\u00e5 fanns mallarna d\u00e4r.
\n Jag t\u00e4nkte att jag saknade beh\u00f6righet f\u00f6r den h\u00e4r CN=Certificate Templates, s\u00e5 med hj\u00e4lp av ADSI Edit gav jag Read f\u00f6r vm_ca$. Jag startade om CertSvc och\u2026 resultatet: Element not found.
\n H\u00e4r k\u00e4nde jag en oro eftersom klockan var 02:00... och CA fungerar inte. Jag st\u00e4nger av CA Windows 2012R2 och \u00e5terst\u00e4ller VM CA Windows 2008R2 fr\u00e5n snapshot. Jag \u00e5terf\u00f6r servern till AD (eftersom det vid inloggningsf\u00f6rs\u00f6k med dom\u00e4nanv\u00e4ndarkonto dyker upp ett fel p\u00e5 relationerna mellan servern<\/a> och AD).
\n Jag t\u00e4nkte... nu borde allt fungera, men tyv\u00e4rr... det \u00e4r fortfarande Certificate Templates \u2014 jag f\u00e5r Element not found. Jag l\u00e4mnar allt tills morgonen \u2014 f\u00f6r morgonen \u00e4r klokare \u00e4n kv\u00e4llen.
\n P\u00e5 morgonen googlade jag, l\u00e4ste olika artiklar \u2014 jag beslutar mig f\u00f6r att installera om CA p\u00e5 den gamla servern<\/a> i hopp om att l\u00f6sa problemet Element Not Found och utf\u00e4rdandet av certifikat via Web.<\/p>\n

Processen \u00e4r ganska enkel:<\/b>
\n1) Ta bort CA-rollen
\n2) Starta om
\n3) V\u00e4nta p\u00e5 att borttagningsprocessen slutf\u00f6rs
\n4) L\u00e4gg till CA-rollen (ange CA, CA Web Enrollment, NDES, Online Responder)
\n5) Ange att jag har Enterprise CA och att jag har en privat nyckel
\n6) V\u00e4nta p\u00e5 att installationen slutf\u00f6rs och \u00e5terst\u00e4ll allt fr\u00e5n backupen som vi gjorde i b\u00f6rjan.
\n7) Som vanligt gick allt bra \u2014 utan fel och tj\u00e4nsten startades<\/p>\n

Med en bultande hj\u00e4rta klickar jag p\u00e5 Certificate Templates \u2014 och\u2026 jag fick en lista \u2014 det \u00e4r redan en liten seger. Kvarst\u00e5r att kontrollera funktionen f\u00f6r certifikatutf\u00e4rdande via webben. Jag g\u00e5r till l\u00e4nken: vm_ca\/certsvc<\/noindex> och klickar p\u00e5 Request a Certificate och vidare till advanced certificate request\u2026 jag anger .csr-f\u00f6rfr\u00e5gan och f\u00e5r det f\u00e4rdiga certifikatet. Jag andas ut\u2026 Att \u00e5terst\u00e4lla CA lyckades.<\/p>\n

Slutsatser:<\/b>
\n1) G\u00f6r alltid en backup och snapshot
\n2) Dokumentera dina \u00e5tg\u00e4rder \u2014 det hj\u00e4lper att \u00e5terf\u00f6ra allt eller hitta felet snabbare<\/p>\n

P.s. Jag m\u00e5ste \u00e5terigen f\u00f6rs\u00f6ka migrera CA fr\u00e5n Windows 2008R till Windows 2012R2.
\n
K\u00e4lla: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0414\u043e\u0431\u0440\u044b\u0439 \u0434\u0435\u043d\u044c \u0443\u0432\u0430\u0436\u0430\u043c\u044b\u0439 \u0447\u0438\u0442\u0430\u0442\u0435\u043b\u044c, \u042f \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0443 \u0412\u0430\u043c \u043e \u0441\u0432\u043e\u0435\u043c \u043a\u043e\u0448\u043c\u0430\u0440\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u044f \u043f\u0435\u0440\u0435\u0436\u0438\u043b \u043c\u0438\u0433\u0440\u0438\u0440\u0443\u044f CA \u0441 Windows 2008R2 \u043d\u0430 Windows 2012 R2. \u0412 \u0438\u043d\u0435\u0442\u0435 \u043e\u0447\u0435\u043d\u044c \u043c\u043d\u043e\u0433\u043e \u0441\u0442\u0430\u0442\u044c\u0439 \u043f\u043e \u044d\u0442\u043e\u043c\u0443 \u043f\u043e\u0432\u043e\u0434\u0443 \u0438 \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u043d\u0435 \u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0431\u044b\u0442\u044c. \u041a \u0441\u0432\u043e\u0435\u043c\u0443 \u0441\u043e\u0436\u0430\u043b\u0435\u043d\u0438\u044e \u2014 \u044f \u043d\u0435 \u043e\u0441\u043e\u0431\u043e Windows Admin, \u044f \u0431\u043e\u043b\u044c\u0448\u0435 *nix \u0430\u0434\u043c\u0438\u043d, \u043d\u043e \u0431\u044b\u043b\u0430 \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u0437\u0430\u0434\u0430\u0447\u0430 \u043c\u0438\u0433\u0440\u0430\u0446\u0438\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31759","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Misslyckad migrering av Certificate Authority (CA) fr\u00e5n Windows 2008R till Windows 2012 R2 | ProHoster","description":"God dag, k\u00e4re l\u00e4sare, jag vill ber\u00e4tta om min mardr\u00f6m som jag upplevde n\u00e4r jag migrerade CA fr\u00e5n Windows 2008R2 till Windows 2012 R2. Det finns m\u00e5nga artiklar p\u00e5 internet om detta och det borde inte ha funnits n\u00e5gra problem.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/ne-udachnaya-migratsiya-certificate-authority-ca-s-windows-2008r-na-windows-2012-r2","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u0435 \u0443\u0434\u0430\u0447\u043d\u0430\u044f \u043c\u0438\u0433\u0440\u0430\u0446\u0438\u044f Certificate Authority(CA) \u0441 Windows 2008R \u043d\u0430 Windows 2012 R2 | ProHoster","og:description":"\u0414\u043e\u0431\u0440\u044b\u0439 \u0434\u0435\u043d\u044c \u0443\u0432\u0430\u0436\u0430\u043c\u044b\u0439 \u0447\u0438\u0442\u0430\u0442\u0435\u043b\u044c, \u042f \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0443 \u0412\u0430\u043c \u043e \u0441\u0432\u043e\u0435\u043c \u043a\u043e\u0448\u043c\u0430\u0440\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u044f \u043f\u0435\u0440\u0435\u0436\u0438\u043b \u043c\u0438\u0433\u0440\u0438\u0440\u0443\u044f CA \u0441 Windows 2008R2 \u043d\u0430 Windows 2012 R2. \u0412 \u0438\u043d\u0435\u0442\u0435 \u043e\u0447\u0435\u043d\u044c \u043c\u043d\u043e\u0433\u043e \u0441\u0442\u0430\u0442\u044c\u0439 \u043f\u043e \u044d\u0442\u043e\u043c\u0443 \u043f\u043e\u0432\u043e\u0434\u0443 \u0438 \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u043d\u0435 \u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0431\u044b\u0442\u044c.","og:url":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/ne-udachnaya-migratsiya-certificate-authority-ca-s-windows-2008r-na-windows-2012-r2","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:42:53+00:00","article:modified_time":"2019-10-31T18:42:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31759","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 21:50:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:11:23","updated":"2026-02-09 21:50:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/31759","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=31759"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/31759\/revisions"}],"predecessor-version":[{"id":160244,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/31759\/revisions\/160244"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=31759"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=31759"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=31759"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}