Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want a peaceful transition from an old standalone CA into an enterprise CA. I am intending to offline the server on completion of this process.

My thought process is to publish a CRL with a long window on the standalone CA and stop the certificate services. From here I'm thinking that I should be able to simply stop the certificate services and build out my enterprise CA as if the standalone box does not exist.

I realize that in doing this I will not be able to revoke certificates on my existing standalone server and that I will eventually need to pull the reference to my old certificate server out of Active Directory.

Are there any hangups I should be aware of going this route and / or a cleaner alternative? I am specifically concerned about having two boxes as authorized CAs in AD.

I realize that this question may cover some of the same ground as this previous question but I'm not looking to keep my old server online.

share|improve this question
what is the reason you are transitioning to an enterprise CA if you desire to keep it offline? – Paul Ackerman Dec 6 '11 at 22:31
Why would you need to stop the certificate services on the old CA before beginning the build of the new CA? – Shane Madden Dec 6 '11 at 23:03
@Paul - I'm intending to offline the existing standalone CA. – Tim Brigham Dec 7 '11 at 14:02
@Shane - My understanding is that there is some interaction between the existing CA and Active Directory which can cause installation problems. Is that not the case? – Tim Brigham Dec 7 '11 at 14:02
up vote 3 down vote accepted

When building an offline root CA with an Enterprise subordinate CA, it is common to setup the root with a long validation period so that you don't have to boot it up often to reissue the Sub CA's certificate.

That being said, you could simply issue the enterprise CA a subordinate CA cert signed by the root whom everyone already trusts. Import the root CA's cert and CRL into AD and you should be good to go. You should, at your convenience re-issue certs that were issued by the standalone on the enterprise CA. Microsoft has pretty detailed guidelines for configuring these different scenarios here

You can't use auto-enrollment without an enterprise CA so I'm not sure why you would be worried about having the offline "published". You might want to just verify in AD Sites & Services - under Services -> Public Key Services -> Enrollment Services that only the enterprise CA is listed upon completion of the install.

share|improve this answer
Thanks for the input. – Tim Brigham Dec 7 '11 at 16:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.