In this demonstration, we're going to back up our certification authority.
We're going to take a checkpoint before this procedure, because
when you restore your certification authority,
it needs to go onto a fresh server, you don't use the old server, and what we're
going to do is kind of simulate a brand‑new server by going back in time before
the certification authority was even installed.
You back up the database, and back up the key, and you
set the location for the backup.
And then finally, we save a copy of the registry, because we
need that in order to restore our certification authority. We
need to create a share on CA2.
This is the way that we can transfer the backup files back
to a new server after we back up CA1.
How you transfer those files is up to you.
This is just kind of a simple way to do it.
I'm going to come down here on CA2, go to This PC, the C drive, and
we'll go ahead and delete these two items right here.
We'll use those to certify CA2.
And what I'm going to do is just come down here and say New Folder.
I'm going to call this cabu, meaning CA backup, spelled
c‑a‑b‑u. I'm going to right‑click on this, go down to the
Properties, go to Sharing, and Advanced Sharing. Share this
folder and then go to the Permissions.
What I want to do is give the administrator full
control over this particular folder.
So I say, Add, type in administrator, check names, I always like to
check names to make sure I got that right, and then click on OK.
We're going to give them full control.
Click on Apply, OK, Apply again, just to make sure,
OK again, and then finally Close.
So we're all ready to go to CA1, map the network drive back to
this location, notice the folder is empty, and store our
backup files inside of this folder.
Let's go to CA1.
We need to go to a command prompt.
So I'll go to Start, type in cmd, and here's the command right here,
net use s, it'll be on the S drive, 10.1.10.20\cabu.
This is the password that I use.
You might have a different password in yours, so make sure
you edit this or it's not going to work.
This is the user, so I have all the credentials.
This is not going to be a persistent connection because we don't want one.
I'm going to go ahead and hit Enter, and just like that,
the command completed successfully.
Let's go ahead and check on to make sure that that
network drive actually went through.
I'll go to My PC, and here it is right here.
So all we really have to do, when it asks us, where do you
want to put the files, we say the S drive, and then we can get
back in here from the new server.
We'll get into the certification authority a little bit different way.
I'm going to go to Server Manager, come up to Tools,
click on Tools, and it's right at the top, Certification
Authority. Click on it, and it loads.
I can expand this, come over here,
say All Tasks after a right‑click, and Back up CA, just like that. Click on
Next after reading this, and we want to back up the private key and CA
certificate, and also the database and certificate database log. Notice this
is grayed out here, Perform incremental backup.
That's because we have not taken a backup yet.
If we did, we could take an increment, or just the changes from the last backup.
Now we have Browse, and we'll fold up some of our file structure right here.
Let me go up.
There's a C drive, and here it is right here.
I'm going to click OK, and we put it right inside of that folder.
I'm going to say Next.
Now we have to have a password.
This is essential for security, because remember, these files allow you to
install a root CA server, so they should be secured.
I'm going to just do a password of one letter, it's a g in
case you're curious, so we can make things a little bit
simple in this demonstration.
I'm going to click on Next, and then Finish, and just like that, we have backed
up the database and root certificate inside of that folder. There's another
thing that we need to do, and that requires regedit.
So I'll type in here reg, that brings up Registry Editor. Click
on it, and as usual, it's a little bit buried.
I'll show you exactly where it is: H_KEY_LOCALMACHINE, SYSTEM,
CurrentControlSet,
Services, and then you scroll down just a bit, a lot of services
in here, there it is right there, CertSrv.
I'm going to even expand this more, and what we're
interested in is the configuration.
I'm going to right‑click this, go down to Export, and we'll save it
right at the same location we did before. The S drive,
click on Open,
add a name to this, and this will be rootca, and it's going to
be a .reg file. Click on Save, and just like that, we have the
backup for this rootca, CA1.
What we're going to do is take this offline.
I'm going to run a checkpoint for a fresh install of Windows Server 2002, and that will be the restoration process I'll show you next.