1

Just joined a new company. Apparently back last year they got rid of the old CA and restored the certificate on a new server. (2003 to 2012). I was about to renew the certificate (self signed) on the CA but realized that:

  • the Cert still is with the old name
  • the new CA server is also a DC!

I am now torn between:

  1. backuping all CA related stuff (DB, Keys, Regs), getting a new server that has the old name and restoring the CA stuff to that server. (almost like here: http://technet.microsoft.com/en-us/library/ee126140%28WS.10%29.aspx#BKMK_RestoreCA)
  2. creating a new server as another (and new) CA and re issue all certs. Aka starting from scratch.

I am leaning towards 1 because it seems let work right now. I am not super expert with CAs.

Do you see any objection for doing 1?

1
  • I am also still investigating what could be done using the current server. As in perhaps install a new certificate to replace that one that was wrongly restored. I still have not found clear answer as to which solution is preferable.
    – KitKatNeko
    Aug 29, 2014 at 1:09

1 Answer 1

0

I am no PKI expert, but I have worked with ADCS a bit.

If all you have of the old CA is the certificate, then I would do (2) (i.e. create a whole new CA and retire the old one). An ADCS CA keeps a database of certificate templates, issued and revoked certificates, etc which it sounds like you no longer have for your old CA. In that case, you are going to have to rebuild, test, and troubleshoot the certificate templates you need for your environment -- this is where the real work lies. Once you have the templates working, it is quick to reissue certificates en masse.

If you try to do (1), you run the risk of confusion because it probably won't be clear which certificates were issued by the old CA vs the new CA. I also suspect that (1) is not a Microsoft-supported practice.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .