Skip to main content
This section shows you how to perform the following tasks to migrate an existing CA key to CryptoHub:
  1. Back up the CA database, CA certificate, and private key on the AD CS server.
  2. Remove the CA role service from the AD CS server.
  3. Import the private key into CryptoHub, name the imported PKI key, and enable Anonymous Signing on the imported CA certificate.
  4. Restore the AD CS server.

​
Back up the CA database, CA certificate, and private key

To back up the CA database, certificate, and private key on the AD CS server, you must use an account that is a CA administrator. On an enterprise CA, the default configuration for CA administrators includes the local Administrators group, the Enterprise Admins group, and the Domain Admins group. On a standalone CA, the default configuration for CA administrators includes the local Administrators group. The following steps use the CA snap-in tool to back up the CA database and private key. If you prefer to complete these steps by using Powershell or Certutil.exe, see the following Microsoft knowledge base article: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn486805(v=ws.11)
1
Choose a backup location and attach media, if necessary.
2
Log on to the source CA.
3
Open the Certification Authority snap-in.
4
Right-click the node with the CA name, select All Tasks, and then select Back Up CA.
5
In the Welcome window of the CA Backup wizard, select [ Next ].
6
In the Items to Back Up window, select the Private key and CA certificate and Certificate database and certificate database log check boxes, specify the backup location, and then select [ Next ].
7
In the Select a Password window, type a password to protect the CA private key and select [ Next ].
8
In the Completing the Backup Wizard, select [ Finish ].
9
After the backup completes, verify the following files in the location you specified:
  • CAName.p12, which contains the CA certificate and private key.
  • The database folder contains the certbkxp.dat, edb#####.log, and CAName.edb files.
10
Open a command prompt window and enter net stop certsvc to stop the AD CS service.
You should stop the service to prevent the issuance of additional certificates. If the source CA issues certificates after a database backup completes, repeat the CA database backup procedure to ensure the database backup contains all issued certificates.
11
Copy all backup files to a location that is accessible from the destination server, such as a network share or removable media.

​
Remove the CA role service

Perform the following steps to remove the CA role service from the AD CS server:
1
In Server Manager, select [ Manage ] in the top menu and select [ Remove Roles and Features ].
2
In the Before you begin section of the Remove Roles and Features Wizard, select [ Next ].
3
In the Select destination server window, leave the default option selected and select [ Next ].
4
In the Remove server roles window, select the Active Directory Certificate Services role.
5
When prompted, select [ Remove Features ].
6
Select [ Next ] until you reach the Confirmation page, and then select [ Remove ].
7
After the removal process completes, close the window and restart the server to finish removing the features.

​
Import the private key into CryptoHub

This section shows you how to create an X.509 certificate container in CryptoHub, import the PKCS #12 file you backed up from AD CS, name the imported PKI key, and enable Anonymous Signing on the imported CA certificate.
You must import the Microsoft ADCS CA private key into CryptoHub as a PKCS #12 file. This imports both the private key and the certificate as a bundle, but Microsoft ADCS uses only the private key for operations.

​
Create an X.509 certificate container

Perform the following steps to create a certificate container for the imported CA:
1
Log in to CryptoHub under dual control using your administrator identities.
2
Go to PKI and CA > Certificate Management.
3
Select [ Add CA ] at the bottom of the page.
4
Configure the following settings for the certificate container:
  • Name: A name for the container, such as Microsoft ADCS.
  • Host: None
  • Type: X.509
  • Owner Group: The Microsoft ADCS role for the service you deployed.
5
Select [ OK ].
6
Right-click the certificate container you created and select Permission. Grant the Microsoft ADCS service the Use permission and select [ Save ].

​
Allow importing certificates with passwords

Your PKCS #12 backup file is password-protected, so you must enable the CryptoHub option that permits password-protected imports before the import succeeds.
1
Go to Classic Tools > Administration > Configuration Tasks > Options.
2
On the Main tab, select the Allow import of certificates using passwords checkbox.
3
Select [ Save ].

​
Import the PKCS #12 file

Perform the following steps to import the CA certificate and private key into the certificate container:
1
Go to PKI and CA > Certificate Management.
2
Right-click the certificate container you created and select Import > PKCS#12.
3
Select [ Browse ] and select the CAName.p12 file you backed up from the AD CS server.
4
Select [ Next ].
5
Enter the password you set when you backed up the CA private key and select [ Next ].
6
Select [ Finish ].
The CA certificate appears in the certificate container in the Certificate Management window.

​
Name the imported PKI key

CryptoHub stores PKI key pairs used by CAs outside of key groups and leaves them unnamed. FXCL CNG finds keys by name, so until you name the imported key, the AD CS Existing Key search returns no results for it. Perform the following steps to name the imported PKI key:
1
Go to Key Management > Key Database.
2
Select [ Reload ] so the key list shows the key you imported.
3
Right-click the imported key pair in the Keys section and select Edit.
4
Under Key Settings, enter a name in the Name field, such as Microsoft ADCS, and select [ OK ] to save.
Record this name. You select it in the AD CS Existing Key window when you re-add the CA role service.
5
Right-click the named key pair and select Permission.
6
Select the Microsoft ADCS service in the drop-down menu and select [ Add ].
7
Grant the Use permission and select [ Save ].
For more information about how CryptoHub stores PKI keys, see Key storage.

​
Enable Anonymous Signing on the imported CA certificate

FXCL CNG signs on behalf of AD CS without an operator approving each operation, so the imported CA certificate must carry the Anonymous Signing security usage. Set it before you associate the certificate with its private key in Windows. Perform the following steps to enable Anonymous Signing:
1
Go to PKI and CA > Certificate Management.
2
Right-click the imported CA certificate and select Change Security Usage.
3
In the drop-down menu, select Anonymous Signing.
4
Select [ OK ] to apply the change.
Security Usage controls the authorization mode for each private key operation, not the purpose of the certificate. Anonymous Signing lets the endpoint authorize each signature on its own, which is what an unattended CA needs.
Complete this step before you run the certutil -repairstore command later in this appendix. If you enable Anonymous Signing after a failed repairstore, you must run the repairstore command again.

​
Restore the AD CS server

This section shows you how to restore the AD CS server by performing the following tasks:
  1. Import the CA certificate.
  2. Re-add the CA role service.
  3. Restore the CA database and configuration.

​
Import the CA certificate

Perform the following steps to import the CA certificate:
1
Start the Certificates snap-in for the local computer account.
2
In the console tree, double-click Certificates (Local Computer) and select Personal.
3
On the Action menu, select All Tasks and select Import to open the Certificate Import Wizard. Select [ Next ].
4
Locate the <CAName>.p12 file created by the CA certificate and private key backup and select [ Open ].
5
Type the password and select [ OK ].
6
Select Place all certificates in the following store.
7
Verify Personal displays in the Certificate store. If you don’t see it, select Browse, select Personal, and then select [ OK ].
The imported CA certificate file was in PKCS #12 format, containing both the certificate and the private key. However, the private key should not exist in AD CS because CryptoHub stores it. The following steps delete both the private key and its association with the CA certificate.
8
In the console tree, double-click Personal Certificates and select the imported CA certificate.
9
On the Action menu, select [ Open ]. Go to the Details tab, copy the serial number to the Clipboard, and select [ OK ].
10
Open a command prompt, type certutil -store My "{Serialnumber}", and then press ENTER.
11
From the output of the preceding command, copy the value that is in the Unique container name field to the clipboard.
12
Run the following command to delete the private key association with the CA certificate:
Powershell
13
Run the following command to delete the private key:
Powershell
The Key Name value is the same as the certificate name, as shown in the Certificates snap-in menu.
14
Finally, associate the private key now stored on CryptoHub with the CA certificate stored in AD CS. Run the following command to repair the association between the imported CA certificate and the private key stored on CryptoHub:
Powershell
Specify the same certificate serial number that you copied earlier in this section.
If the command reports that it completed successfully but also reports that it could not match the certificate’s public key with the private key, the certificate and key are correctly paired and CryptoHub is refusing the verification signature. Confirm that the imported CA certificate has the Anonymous Signing security usage and that the imported PKI key has a name, then run the repairstore command again.
15
Run the following command to verify that the CA certificate is bound to the private key stored on CryptoHub:
Powershell
Locate the CA certificate in the output and confirm the following fields:

​
Re-add the CA role service

Perform the following steps to re-add the CA role service by using the server manager:
1
In the console tree, select Roles.
2
On the Action menu, select Add Roles.
3
In the Before you Begin window, select [ Next ].
4
In the Select Server Roles window, select the Active Directory Certificate Services checkbox and select [ Next ].
5
In the Introduction to AD CS window, select [ Next ].
6
In the Role Services window, select the Certificate Authority checkbox and select [ Next ].
7
In the Specify Setup Type window, specify either Enterprise or Standalone, to match the source CA. Then select [ Next ].
8
In the Specify CA Type window, specify either Root CA or Subordinate CA to match the source CA. Then, select [ Next ].
9
In the Set Up Private Key window, select Use existing private key and Select a certificate and use its associated private key.
10
In the Certificates list, select the imported CA certificate and select [ Next ].
The search returns only named keys. If the key doesn’t appear, complete the Name the imported PKI key section earlier in this appendix.
11
In the CA Database window, specify the locations for the CA database and log files. Select [ Next ].
12
In the Confirmation window, review the messages and select [ Configure ].

​
Restore the CA database and configuration

After you reinstall the CA role service, perform the following steps, which use the CA snap-in tool to restore the CA database and configuration:
1
Start the Certification Authority snap-in.
2
Right-click the node with the CA name, select All Tasks, and then select Restore CA.
3
In the Welcome window, select [ Next ].
4
In the Items to Restore window, select Certificate database and certificate database log.
5
Select [ Browse ]. Navigate to the parent folder that holds the Database folder (the folder that contains the CA database files created during the CA database backup).
Do not select the Database folder. Select its parent folder.
6
Select [ Next ] and then [ Finish ].
7
Select [ Yes ] to start the CA service (certsvc).