0

In our environment we have three type of machines: Root CA (Microsoft CA), web servers and user PCs.

We need to move our Root CA to another site, there are many guidelines on how to migrate Root CA by backup and restore it. But do I need to reissue all certificates on web servers since the FQDN and IP address of the Root CA will change as well? Or simply CNAME the old FQDN to new host name and IP will do the trick? I would assume as long as user PCs could reach Root CA via old or new FQDN, it should work, am I correct?

**We only have one Root CA server and nothing else, all certificates work are done on this host only.

Improve this question
1
  • 1
    "...FQDN and IP address of the Root CA..." - why should a Root CA have FQDN and IP address in the first place? These are information associated with a server certificate, not with a root CA.
    – Steffen Ullrich
    Commented Feb 10, 2020 at 9:05

1 Answer 1

Reset to default
1

No, you don't have to reissue certificates. Be sure that you are using official ADCS migration guide to move CA server to another host. Take extra attention to Verifying certificate extensions on the destination CA section.

Improve this answer
2
  • does it mean it's possible to do a seamless move?
    – Thomas G. Lau
    Commented Feb 10, 2020 at 13:04
  • Yes. Though, I would recommend to plan migration and consult with experienced people to verify your plan. ADCS migration always was too complex when comparing to initial installation. And make CRL validity long enough before migration to get extra time to fix issues if problems arise.
    – Crypt32
    Commented Feb 10, 2020 at 18:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .