2

I want a peaceful transition from an old standalone CA into an enterprise CA. I am intending to offline the server on completion of this process.

My thought process is to publish a CRL with a long window on the standalone CA and stop the certificate services. From here I'm thinking that I should be able to simply stop the certificate services and build out my enterprise CA as if the standalone box does not exist.

I realize that in doing this I will not be able to revoke certificates on my existing standalone server and that I will eventually need to pull the reference to my old certificate server out of Active Directory.

Are there any hangups I should be aware of going this route and / or a cleaner alternative? I am specifically concerned about having two boxes as authorized CAs in AD.

I realize that this question may cover some of the same ground as this previous question but I'm not looking to keep my old server online.

Improve this question
4
  • what is the reason you are transitioning to an enterprise CA if you desire to keep it offline?
    – Paul Ackerman
    Dec 6, 2011 at 22:31
  • Why would you need to stop the certificate services on the old CA before beginning the build of the new CA?
    – Shane Madden
    Dec 6, 2011 at 23:03
  • @Paul - I'm intending to offline the existing standalone CA.
    – Tim Brigham
    Dec 7, 2011 at 14:02
  • @Shane - My understanding is that there is some interaction between the existing CA and Active Directory which can cause installation problems. Is that not the case?
    – Tim Brigham
    Dec 7, 2011 at 14:02

1 Answer 1

Reset to default
3

When building an offline root CA with an Enterprise subordinate CA, it is common to setup the root with a long validation period so that you don't have to boot it up often to reissue the Sub CA's certificate.

That being said, you could simply issue the enterprise CA a subordinate CA cert signed by the root whom everyone already trusts. Import the root CA's cert and CRL into AD and you should be good to go. You should, at your convenience re-issue certs that were issued by the standalone on the enterprise CA. Microsoft has pretty detailed guidelines for configuring these different scenarios here

You can't use auto-enrollment without an enterprise CA so I'm not sure why you would be worried about having the offline "published". You might want to just verify in AD Sites & Services - under Services -> Public Key Services -> Enrollment Services that only the enterprise CA is listed upon completion of the install.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .