Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm setting up a new Windows 2008 R2 server to take over from a older Windows 2003 box in a small windows domain. I discovered that the old server is running the only certificate service in the domain. Do I need to take any special steps, or can I just run the certificate service on the new server?

Update: It seems that my root certificate expired a few days ago. Would I be just as well off moving to the new server directly as renewing the old certificate?

share|improve this question
add comment

1 Answer

Your best bet is to back up the certificate store on your old server and restore it to the new server. TechNet has an article describing how to do it at http://technet.microsoft.com/en-us/library/cc755153%28WS.10%29.aspx

share|improve this answer
    
Is it really necessary to use the same server name? Would my network be toast if the CA got hit by a bus? –  Justin Love Feb 6 '11 at 16:53
    
@JustinLove Yes, you DO have to use the exact same server-name. The CA certificate lists that name in its Subject line, and hosting that CA on a different server would cause it to fail validation. This does introduce a single-point-of-failure, which is why the commercial CAs are using Intermediate CAs signed by their Roots these days. –  sysadmin1138 Feb 6 '11 at 18:52
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.