Back up and restore a Certificate Authority in Windows 2000

This section describes how to back up and restore a Certificate Authority (CA ).

The Windows 2000 Certificate Service provides backup and restoration tools for recovering disaster-affected CA computers. You can use CA backup and restoration tools to back up and restore keys, certificates, and certificate databases.

You can use the Certificate Authority backup Wizard to create a full backup, and then create an incremental backup after the complete backup is complete. When you restore the Certificate database, first restore the complete backup, and then restore all Incremental backup in the order of Incremental Backup creation.

After the CA is restored, you may need to restore the Microsoft Internet Information Service (IIS) metadatabase. The IIS metadatabase stores information about IIS configuration on the CA. This step is required only when the metadatabase is lost or damaged along with the certificate service information. If the damaged metadatabase is not restored, the Certificate Service Web page is not loaded.

Backup Certificate Service

1.	ClickStart, PointingProgram, PointingManagement toolsAnd then clickCertificate Authority.
2.	Right-click CA and pointAll tasksAnd then clickBackup CA.
3.	On the "Welcome to Certificate Authority backup wizard" Page, read the instructions and clickNext step.
4.	On the "Project to be backed up" page, click to select the "private key and CA certificate" check box and the "issued certificate log and pending Certificate Application queue" check box. In the "back up to this location" box, type the local path of an empty folder. If this folder does not exist, the wizard will create a folder. ClickNext step.
5.	In the "select password" dialog boxPasswordEnter the password in the dialog box, and then enter the password again in the "Confirm Password" box. ClickNext step.
6.	On the Complete Certificate Authority backup wizard page, clickComplete. The progress bar appears to show the status of the backup job. After the backup job is complete, return to the CA console.

Restore Certificate Service

1.	ClickStart, PointingProgram, PointingManagement toolsAnd then clickCertificate Authority.
2.	Right-click CA and pointAll tasksAnd then clickRestore CA. When you receive the message "Certificate Authority restore wizard" to inform you that the certificate service cannot run during restoration, clickOKTo stop the Certificate Service.
3.	On the "Welcome to Certificate Authority restore wizard" Page, read the instructions and clickNext step.
4.	On the "items to be restored" page, click to select the "private key and CA certificate" check box and the "issued certificate log and pending Certificate Application queue" check box. In the "restore from this location" box, type the path of the Certificate Service backup, or clickBrowseTo locate the folder. ClickNext step.
5.	On the "provide password" pagePasswordBox, enter the password used during the Certificate Service backup. ClickNext step.
6.	On the Complete Certificate Authority restore wizard page, clickComplete.
7.	After restoration,Certificate Authority restore wizardThe dialog box notifies you That the restore operation has been completed and prompts you to start the Certificate Service. ClickOKStart the Certificate Service.

Back up IIS metadatabase

1.	ClickStart, PointingProgram, PointingManagement toolsAnd then clickInternet Information Service.
2.	Right-click your server name, and then clickBackup/restore Configuration.
3.	InConfigure backup/restoreIn the dialog box, click Create backup ".
4.	InConfigure backupIn the dialog box, enter the backup name, and then clickOK.
5.	The backup is displayed onBackupWindow. ClickClose.

Restore the IIS metadatabase

1.	ClickStart, PointingProgram, PointingManagement toolsAnd then clickInternet Information Service.
2.	Right-click your server name, and then clickBackup/restore Configuration.
3.	InConfigure backup/restoreIn the dialog box, enter the name of the backup you want to create, and then clickRestore.
4.	DisplayInternet Service ManagerThe dialog box notifies you that the restoration process is a long operation, and all settings since the last backup will be lost. ClickYes.
5.	After the backup is complete,Internet Service ManagerThe dialog box notifies you that the operation has been completed successfully. ClickOK.
6.	InConfigure backup/restoreIn the dialog box, clickClose.

Note:: These steps are only available if the service has failed to be installed on an existing Windows 2000 instance. If you must replace the entire server, you must back up the system status and restore the Certificate Service and metadata from the system status backup. Certificate Service information and metadata will be automatically backed up during system status backup.