Migrate single windows server 2012 R2 CA server to windows 2022 server and implement PKI 2 tier

The following might be able to provide the required information:

https://techcommunity.microsoft.com/t5/itops-talk-blog/step-by-step-migrating-the-active-directory-certificate-service/ba-p/697674

https://techcommunity.microsoft.com/t5/itops-talk-blog/step-by-step-migrating-active-directory-certificate-service-from/ba-p/2328766

https://v4.hkg1.meaqua.org/en-us/troubleshoot/windows-server/identity/move-certification-authority-to-another-server

Hello Mahela Walpola,

Thank you for posting in Q&A forum.

Based on the description "In current environment we have windows server 2012 R2 CA server", is your existing windows server 2012 R2 CA server an offline standalone CA or an online enterprise CA server?

If it is an offline standalone CA server, you can migrate windows server 2012 R2 CA server to windows 2022 server, it will act as one offline root CA server. And then you add two subordinate CA servers.

If it is an online enterprise CA server, you can try to migrate online enterprise CA server to an offline standalone CA server (not sure if an online enterprise CA server can be migrated to an offline standalone CA server, I suggest you can try on test lab first), it will act as one offline root CA server. And then you add two subordinate CA servers.

For adding two subordinate CA servers, you can refer to the part "Install Enterprise Issuing CA".

https://social.technet.microsoft.com/wiki/contents/articles/15037.ad-cs-step-by-step-guide-two-tier-pki-hierarchy-deployment.aspx#:~:text=Install%20the%20Active%20Directory%20Forest%20Prepare%20the%20web,post%20installation%20configuration%20on%20the%20subordinate%20issuing%20CA

For CA migration, please refer to this similar thread.
https://social.technet.microsoft.com/Forums/windowsserver/en-US/0b2e5613-17e0-462c-8a31-f13d0e4dffba/root-ca-migration-from-2008-r2-to-2016?forum=winserversecurity

Note: Please do all the steps in test lab first, and then in production environment.

Hope the information above is helpful.

If you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.