Migrating certificate server to Windows 2016/2019

Migrating a single CA Server from Windows Server 2012 R2 to Windows Server 2019.

To install an enterprise CA or a standalone CA on a domain member computer, you must be a member of the Enterprise Admins group or Domain Admins group in the domain. To install a standalone CA on a server that is not a domain member, you must be a member of the local Administrators group. Removal of the CA role service from the source server has the same group membership requirements as installation.

Preparing to migrate

Preparing your destination server
Backing up your source server
Preparing your source server

Migrating the certification authority

Backing up a CA database and private key
Backing up CA registry settings
Backing up CAPolicy.inf
Removing the CA role service from the source server
Removing the source server from the domain
Joining the destination server to the domain
Adding the CA role service to the destination server
Restoring the CA database and configuration on the destination server
Granting permissions on AIA and CDP containers
Additional procedures for failover clustering (optional)

Backing up CAPolicy.inf
If your source CA is using a custom CAPolicy.inf file, you should copy the file to the same location as the source CA backup files.

The CAPolicy.inf file is located in the %SystemRoot% directory, which is usually C:\Windows