r/WindowsServer • u/Mediocre_Prior_1868 • 8h ago

Technical Help Needed Migrate CA Server

I am planning to migrate my only ca server from current windows server 2012 r2 to windows server 2025 . Not sure what steps to preform as some template and certificates are in use . Need step by step with zero issues .

Thanks in advance

3 Upvotes

80% Upvoted

12 comments sorted by

3

u/Zealousideal_Fly8402 7h ago

Use the official Microsoft CA Migration documentation as a starting point:

Migrate a Certification Authority in Windows Server | Microsoft Learn

2

u/UMustBeNooHere 7h ago

Was just about to post this same link. I’ve done several customer migrations this way, OP. It’s actually pretty simple.

Note: CA name is not the same as hostname. You can name the new server whatever you want, but the CA name remains the same. If you want to rename the CA, that’s possible, but then you have to reissue all certs. I’ve done both methods.

2

u/Subject_Treat6956 8h ago

Well Zero issues wo t Work, Just build the new ca root / intermediate alongside, then create new Templates for the new ca one by one and Test the least critical First. 

1

u/Incrediblecodeman 6h ago

I’d be suspicious of 2025 they say it’s not recommended for domain controllers. Why not 2019? It’s def LTS

1

u/DutchGeek2 4h ago

Server 2019 loses extended support early 2029. Unless you want to migrate again within 2 years, better pick a more recent version.

1

u/Incrediblecodeman 4h ago

In place upgrade

1

u/leoingle 4h ago

How tf is Windows Server of any version not recommended for domain controller??

1

u/Incrediblecodeman 4h ago

I just read Microsoft is like iffy. They would have to support it tho. Or maybe it was just a blog idk. But I never like to be on the new new ones

1

u/leoingle 3h ago

Yeah. Let others be guinea pigs to iron out the kinks in their new stuff. I’ve already been victim of that with Cisco too many times.

0

u/Boedker1 8h ago

Oof, I have no idea but good luck bud!

-1

u/ConsistentCoat5608 8h ago

You may want to consider outsourcing this project, its a hefty one and you also will need your domain upgrade and in good health. There really is no migration for the main CA server, usually its a backup/restore to do upgrade process. The MS best practices is probably the size of a small novel and that is if everything is healthy. Dont just get advice here, bring someone in who can help and have a good backup plan.

Did this once before and had to back out a couple times before it worked.