Migrate Server 2008 Certificate Authority To New Server Different Host Name?

Question

Our internal CA is installed on one of our Exchange servers.  Exchange is being migrated from 2010 to 2013, so all current Exchange servers will decommissioned and replaced with new new Hyper-V VMs with either Server 2008 R2 or 2012 R2 OS. The old VM
containing Exchange 2010 and the current CA will go away since we cannot afford to use the server resources and use up the required Windows license to keep that server running doing nothing but acting as a CA.
So, we will either need to move the CA to the new replacement Exchange 2013 server or some other existing server that's being used for something else (maybe one of the domain controllers).
What is the best way to handle this?  I don't think the migration from Exchange 2010 to 2013 allows for reusing the same host name on the replacement server and if we move the CA to another existing server, it will also be on a server with a new host
name anyways.
Can we migrate the CA to a new server with a different host name?
What about reissuing all the active certificates from the current server to replace them with new certificates from the new server and then decommissioning the original CA?  Can this be automated in some way?
Which way is best and how would it be done?

Answer 1

When following the instructions in the guide, I would also consider to switch to new "sanitized" URLs in certificates (CDP and AIA) in case you had used the default URLs now. That's what I did this when migrating W2K3 CAs (with default URLs) to W2K8 R2.
Per default, the LDAP and HTTP URLs point to the CA server itself (HTTP) or to an LDAP objects that has the same name as the current server.
Migrating to a new server, you need to make sure that CRLs will still be published to the old locations - thus the new CA server would write to the LDAP object that corresponded to the old server, and HTTP might be fixed by redirecting the DNS record. (Make
sure this is documented so that nobody thinks it might be a good idea to delete the old object as it "references a server that does not exist anymore".)
As you have to fiddle with URLs anyway, I would then add new URLs having neutral names - that is URLs not including the name of the CA server. The new CA instance would then 1) publish to the old locations but not add these to certificates anymore and 2)
publish to new sanitized locations and add them to CDP and AIA URLs.
Elke