Migrating a Microsoft CA Certificate (1)

Recently beans need to clean up the company's PKI server. Due to historical reasons, the company before the intranet built 2 enterprise root level of the CA server, the boss let me build a new, and then the previous 2 to dispose of. Microsoft's ad environment is allowed to build multiple PKI structures at the same time, but the result is that it is possible for the client to apply for a certificate at random, the consequences of which is difficult to manage.

After a study, we found that the general process is as follows:

1. Install a new CA

2. Uninstall the certificate template (certificate templates) on the old CA so that you cannot continue to issue a new certificate

3. Add the corresponding template on the new CA

4. Manual-issued certificates can be manually updated

5. For automatic enroll certificates you can point to a new CA through Reenroll, where you need to configure the corresponding Group Policy

6. Repeat 4-5 until all the certificates have been successfully modified to replace, and finally turn off the old CA

7. If you need to turn off the old CA immediately, you need to consider extending the CRL time

First, build a simulation environment to try

Basic Environment:

R2 Domain Control DC1

R2 Certificate Server CA2 (new CA)

R2 Certificate Server CA1 (old CA)

R2 Web Server WEB1

Window 7 Client Win7

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M01/74/78/wKioL1Ye4xOBfQ79AACWalPgcik289.jpg "title=" 1.PNG " Style= "Float:none;" alt= "wkiol1ye4xobfq79aacwalpgcik289.jpg"/>

Experimental process: Issuing EFS certificate from CA1, DomainController certificate and Web Server certificate, configuring in corresponding client; Then install CA2 as the new root CA; Manually change the certificate to a new CA

The next step is to simulate the process of signing

First install ad CS on CA1, the process is slightly

After the installation is successful, you can view it through IIS

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M02/74/7C/wKiom1Ye4vPxFUjCAAMHVqVveSs917.jpg "style=" float: none; "title=" 2.PNG "alt=" Wkiom1ye4vpxfujcaamhvqvvess917.jpg "/>

Next Configure the EFS certificate, which EFS can allow users to encrypt their own documents.

Login Win7 client, Control Panel

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M02/74/78/wKioL1Ye4xbijPCDAADrV-sWAtc880.jpg "style=" float: none; "title=" 3.PNG "alt=" Wkiol1ye4xbijpcdaadrv-swatc880.jpg "/>

To create a new certificate

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M00/74/7C/wKiom1Ye4vaS_tJbAAFUEFXQ-JA010.jpg "style=" float: none; "title=" 4.PNG "alt=" Wkiom1ye4vas_tjbaafuefxq-ja010.jpg "/>

Issued from a CA within a domain

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M02/74/78/wKioL1Ye4xigWBHlAAEhueUFcyo845.jpg "style=" float: none; "title=" 5.PNG "alt=" Wkiol1ye4xigwbhlaaehueufcyo845.jpg "/>

Successfully issued from CA1

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M01/74/7C/wKiom1Ye4vmAhPctAAD1iV7KjkE358.jpg "title=" 7.PNG " Style= "Float:none;" alt= "wkiom1ye4vmahpctaad1iv7kjke358.jpg"/>

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M00/74/7C/wKiom1Ye4viDMv6bAAFkalIAyVM567.jpg "style=" float: none; "title=" 6.PNG "alt=" Wkiom1ye4vidmv6baafkaliayvm567.jpg "/>

Specify an object to encrypt with this certificate

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M00/74/78/wKioL1Ye4xvAinrfAADkW03VeTM468.jpg "style=" float: none; "title=" 8.PNG "alt=" Wkiol1ye4xvainrfaadkw03vetm468.jpg "/>

Once the certificate has been created, go back to the C:\Confidential folder and open the encrypted option

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M02/74/7C/wKiom1Ye4vug9dJ4AAHGTqbj3H4276.jpg "style=" float: none; "title=" 9.PNG "alt=" Wkiom1ye4vug9dj4aahgtqbj3h4276.jpg "/>

You can see this folder turned green, and then create a new file inside it, and he will automatically encrypt it with the certificate.

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M01/74/78/wKioL1Ye4x3w-Q0bAAF7IVIMUu0721.jpg "style=" float: none; "title=" 10.PNG "alt=" Wkiol1ye4x3w-q0baaf7ivimuu0721.jpg "/>

Next, I need to create a DomainController certificate. Log in to domain control and add Certificate snapin from MMC

Then send a certificate request

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M00/74/78/wKioL1Ye4yGCA4DzAAFPTOtHGl0887.jpg "style=" float: none; "title=" 11.PNG "alt=" Wkiol1ye4ygca4dzaafptothgl0887.jpg "/>

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M01/74/7C/wKiom1Ye4wKjZ-nAAACa06w8lb0383.jpg "style=" float: none; "title=" 12.PNG "alt=" Wkiom1ye4wkjz-naaaca06w8lb0383.jpg "/>

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M01/74/78/wKioL1Ye4yPiveIkAACiFLlN8H0858.jpg "style=" float: none; "title=" 13.PNG "alt=" Wkiol1ye4ypiveikaaciflln8h0858.jpg "/>

Select the type of certificate you want

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M02/74/7C/wKiom1Ye4wSyzOxOAADB0joO3s8085.jpg "style=" float: none; "title=" 14.PNG "alt=" Wkiom1ye4wsyzoxoaadb0joo3s8085.jpg "/>

Successfully issued

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M02/74/78/wKioL1Ye4yagq1fHAADuXg4a5Ow772.jpg "style=" float: none; "title=" 15.PNG "alt=" Wkiol1ye4yagq1fhaaduxg4a5ow772.jpg "/>

Finally, a certificate for the Web server needs to be issued. Login WEB1, open Iis,server certificate inside can request

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M00/74/7C/wKiom1Ye4wbigYZSAAEq_BDSjqo390.jpg "style=" float: none; "title=" 16.PNG "alt=" Wkiom1ye4wbigyzsaaeq_bdsjqo390.jpg "/>

The specific steps are slightly

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M00/74/78/wKioL1Ye4yjQr-nPAAEHEFWcuKg519.jpg "style=" float: none; "title=" 17.PNG "alt=" Wkiol1ye4yjqr-npaaehefwcukg519.jpg "/>

After the certificate is successfully imported, then bind the certificate to HTTPS

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M00/74/7C/wKiom1Ye4wnw0qj-AADRtcAx76g153.jpg "style=" float: none; "title=" 18.PNG "alt=" Wkiom1ye4wnw0qj-aadrtcax76g153.jpg "/>

The certificate for EFS, domain and WEB server has now been successfully issued.

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M01/74/7C/wKiom1Ye4wnBGmppAAD4gw9oJAM036.jpg "style=" float: none; "title=" 19.PNG "alt=" Wkiom1ye4wnbgmppaad4gw9ojam036.jpg "/>

Next we'll look at how to update to CA2.

Resources:

1.http://blogs.technet.com/b/askds/archive/2010/08/23/ Moving-your-organization-from-a-single-microsoft-ca-to-a-microsoft-recommended-pki.aspx

2.http://blogs.technet.com/b/pki/archive/2012/01/27/ Steps-needed-to-decommission-an-old-certification-authority-without-affecting-previously-issued-certificates-and-then-swi Tching-all-operations-to-a-new-certification-authority.aspx

Migrating a Microsoft CA Certificate (1)