Windows 10: Standalone, workgroup Root CA Replacement

I have a Server 2008 Root CA that is in Workgroup mode. It's usually powered off but does have a NIC that is connected when it powers on every few months for Windows updates. If I use the steps that are available for migrating a CA to a new 2019 server, do I need to still perform the step to uninstall the CA role given that the old Root CA has never been on the Domain? The plan is to build the new CA with the same machine name and also have it stay Workgroup. Thanks very much.

:)

 

Symbian^3 preinstalled root CA

Hello,

could you help me to get the list of preinstalled root CA on Symbian^3 devices?

The problem is that I have no access to the device.

Best regards,

Monika

 

CA root and SUB CA for MS2016and2019

hi,

thank you for your time reading my question.

I'm on the stage of putting up a sub CA under MS Server 2019 but my Root CA is hosted under MS server 2016, is there any issue or incompatibility when provisioning this approach.

 

Accept self-signed certificate system-wide without installing as root CA

If the server is under your control:

1. Create an actual root CA (e.g. with easy-rsa or Xca or Windows Server CA role).
   
2. Replace the self-signed server certificate with one issued by your custom CA.
   
3. Make sure the certificate you just issued is actually marked as a "leaf" / "end-entity" certificate. Look for the "X.509v3 Basic Constraints" extension – it must be present and say "CA: FALSE".
   
4. Install the custom CA's root certificate into your computer.
   
5. Safely store the CA private key so that it's only accessible whenever you need to issue a new cert.
   

As the server's certificate contains "Basic Constraints: CA: FALSE", it will not be able to issue new certificates using just its own key.

(The reason you need the CA to be separate is because directly installing the server's self-signed certificate into the "Trusted CA" folder may cause the system to ignore Basic Constraints – after all, it's installed as an authority. Separation avoids this problem, because you can safeguard the root CA keys.)

As a bonus feature, you won't need to re-trust the server certificate when it expires or when its name changes – just use the same root CA to issue a new cert.