Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm setting up a new Windows 2008 R2 server to take over from a older Windows 2003 box in a small windows domain. I discovered that the old server is running the only certificate service in the domain. Do I need to take any special steps, or can I just run the certificate service on the new server?

Update: It seems that my root certificate expired a few days ago. Would I be just as well off moving to the new server directly as renewing the old certificate?

share|improve this question

Your best bet is to back up the certificate store on your old server and restore it to the new server. TechNet has an article describing how to do it at

share|improve this answer
Is it really necessary to use the same server name? Would my network be toast if the CA got hit by a bus? – Justin Love Feb 6 '11 at 16:53
@JustinLove Yes, you DO have to use the exact same server-name. The CA certificate lists that name in its Subject line, and hosting that CA on a different server would cause it to fail validation. This does introduce a single-point-of-failure, which is why the commercial CAs are using Intermediate CAs signed by their Roots these days. – sysadmin1138 Feb 6 '11 at 18:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.