Organizations have different reasons and requirements for upgrading or migrating to Active Directory Certificate Services (AD CS). They include:
Open the Certification Authority snap-in.
In the Certification Authority snap-in, right-click the A name, click All Tasks, and then click Back up CA to start the Certification Authority Backup Wizard.
Click Next, and select the Private key and CA certificate and Certificate database and certificate database log check boxes.
Specify an empty folder or storage media as the backup location, and then click Next.
Type a password for the CA private key backup file, and type it a second time to confirm the password.
Click Next, verify that the Private Key and CA Certificate and Issued Log and Pending Requests backup settings are displayed, and then click Finish.
Click Start, click Run, type regedit, and then click OK.
Locate and right-click the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration
Click Export.
Save the registry file in the CA backup folder that you used for the Certification Authority Backup Wizard.
Uninstall the CA from the old server, and then rename the old server or permanently disconnect it from the network.
Before you begin the restore procedure, confirm that the %Systemroot% folder of the target server running Windows Server 2008 matches the %Systemroot% folder of the server from which the backup is taken.
In addition, the location of the CA restore must match the location of the CA backup. For example, if you back up the CA from the D:\Winnt\System32\Certlog folder, you must restore the backup to the D:\Winnt\System32\Certlog folder. After you restore the backup, you can move the CA database files to a different location.
To restore a CA on a new server from a backup copy
Open Server Manager, and click Active Directory Certificate Services. Click Next two times.
On the Select Role Services page, select the Certification Authority check box, and then click Next.
On the Specify Setup Type page, click either Standalone or Enterprise, and then click Next.
On the Specify CA Type page, click the appropriate CA type, and then click Next.
On the Set Up Private Key page, click Use existing private key, click Select a certificate and use its associated private key, and then click Next.
On the Select Existing Certificate page, click Import, type the path of the .P12 file in the backup folder, type the password that you chose in the previous procedure to protect the backup file, and then click OK.
In the Public and Private Key Pair dialog box, verify that Use existing keys is selected.
Click Next two times.
On the Configure Certificate Database page, specify the same location for the certificate database and certificate database log as on the previous CA computer. Click Next.
On the Confirm Installation Options page, review all of the configuration settings that you have selected. If you want to accept all of these options, click Install and wait until the setup process has finished.
Open the Services snap-in to stop the Active Directory Certificate Services (AD CS) service.
Locate the registry file that you saved in the backup procedure, and then double-click it to import the registry settings. If the path that is shown in the registry export from the old CA differs from the new path, you must adjust your registry export accordingly.
Open the Certification Authority snap-in, right-click the CA name, click All Tasks, and then click Restore CA to open theCertification Authority Restore Wizard.
Type the backup folder location, and then click Next.
Verify the backup settings. The Issued Log and Pending Requests settings should be displayed.
Click Finish, and then click Yes to restart AD CS when the CA database is restored.