Subject Key Identifier (SKI) changed after RootCA upgrade

Question

Hello,
I have a RootCA running windows 2003 ENT SP2 and I made an upgrade to a new machine (newer HW) and Windows 2008 R2.  The original rootCA was configured with an HSM, so the backup CA is not an option for me since the keys can not be exported (I dont
have a .p12 file).
I exported the HSM settings together with the keys (HSM vendor's procedure) and during the CA setup wizard, I select the option: "Use existing private key” and then “Select an existing private key on this computer” .  Then I click on "edit"
select the correct CSP (the one from the HSM) and click on "Search".  The private key appears immediately, I select it and i keep going with the installation.  It all goes smoothly and CA services are correctly installed.
The problem is that the SKI of the new CA certificate does not match with the SKI of the original CA certificate, it is changed somehow during the installation. 
I have performed the same test, but migrating to another windows 2003 server, and the SKI is kept exactly the same, there is no difference (maybe the way the SKI is generated is different from windows 2003 to 2008).
My applications communicate to each other using this SKI, replacing it everywhere is something that i dont want to consider.
Does somebody know if it is possible to force this setting to be kept?
Thanks in advance
Best regards

Answer 1

Hi Vadims,
Thanks for your reply,  I have been playing a bit with openssl and a CA certificate, and in the meantime i solved the issue, and this is what I "guess" or what I understand from it:
1) If you install CA services and use the options:  select and existing key --> select a certificate  --> then you will have to choose a p12 file which contains both (public and private key) and will use both values to generate a NEW certificate,
but it will NOT generate the SKI value, it will just use the one from the p12 file.  That is why the SKI does not change if you use this option
2) I am using an HSM and the private key is stored there and can not be exported, so, i can not generate a p12 file, in that case, I have the opther option in the wizard:  select an existing key --> use an existing key.... Then i can choose the correct
private key from the HSM once i select the correct CSP... And then the fun begins:
3) Acording to the RFC
For CA certificates, subject key identifiers SHOULD be derived from
   the public key or a method that generates unique values.  Two common
   methods for generating key identifiers from the public key are:
      (1) The keyIdentifier is composed of the 160-bit SHA-1 hash of the
      value of the BIT STRING subjectPublicKey (excluding the tag,
      length, and number of unused bits).
      (2) The keyIdentifier is composed of a four bit type field with
      the value 0100 followed by the least significant 60 bits of the
      SHA-1 hash of the value of the BIT STRING subjectPublicKey
      (excluding the tag, length, and number of unused bit string bits).
4) After all my openssl adventure, it all came down to 2 files containing the public key and the BIT STRING of the public key,  I opened them both and I confirmed that for the SKI generated on the windows 2008 machine, the method used to calculate the
SKI is using the BIT STRING (option (1) from the RFC) 
While for the SKI generated in the windows 2003 machine, the method is :  ???????
What I think is that from windows 2003 to windows 2008 the certificate services changed the way they calculate the SKI.
First they were maybe doing a SHA1 of the whole public key and now they are using a SHA1 of only the bitstring of the public key which is more similar to what is said on the RFC (point 1)).
Then I started to look if there was a way to change this, and....