In-Place Upgrade of a Certification Authority from Windows Server 2008 SP2 to Windows Server 2008 R2

Author Uwe GradeneggerPosted on Categories Windows operating system, Certification AuthorityTags

At the latest within the scope of the End of product support by the manufacturer (Microsoft) The question arises as to whether the Certification Authority should be Migration to another server to an up-to-date operating system, or performs an in-place upgrade. The latter process is described below.

Support for Windows Server 2008 SP2 and Windows Server 2008 R2 expires on January 14, 2020. (see article "End of product support by the manufacturer (Microsoft)") If any problems occur during the migration, there is usually no support available from Microsoft.

Instead of an in-place upgrade, it is strongly recommended to migrate the certificate authority to another server with a current operating system. See article "Migration of an Active Directory integrated certification authority (Enterprise Certification Authority) to another server„.

It is not possible to upgrade from a 32-bit installation of Windows Server 2008 to a newer version of Windows, as these are now only released as 64-bit versions. The only way to upgrade such a certificate authority is to migrate to a new server with the latest operating system. See article "Migration of an Active Directory integrated certification authority (Enterprise Certification Authority) to another server„.

Downgrading a Windows edition, e.g. from Windows Server Datacenter to Windows Server Standard, is not supported.

Preparatory work

Implementation of the upgrade

After the data medium for the new operating system has been inserted, the installation can be started.

Usually, server systems do not have an Internet connection anyway, so the option to download updates can be deselected here. However, please note that in this case the server will start up again without security updates. This will result in the remote desktop connection from a current client no longer working, since the update for the security vulnerability CVE-2018-0866 has not yet been installed.

In the next dialog the license conditions are accepted in order to continue.

In the next dialog, it is essential to select the "Upgrade" option so that the certification authority installation is retained. If only the option "Custom (advanced)" can be selected here, either the operating system language or the operating system edition does not match.

A compatibility report is then displayed. For a certification authority, there should be no peculiarities here, so that you can continue.

This is followed by the installation of the new operating system. The server will reboot several times before it can be used again with the new operating system.

Problem solving

Remote desktop connection no longer possible after in-place upgrade

Most likely, remote desktop connection to the server will not be possible after the in-place upgrade. For the reason and solution see article "Remote desktop connection no longer possible after in-place upgrade of Windows Server operating system„.

Rework

  • Activate Windows, if required. After the upgrade, the server may still need to be connected to a KMS server, or the operating system may need to be activated.
  • Install current Windows updates. The server starts without security updates, so they must be installed immediately.
  • If you have upgraded from a certificate authority that was running on Windows Server 2008 R2 or older, you may want to adjust the serial number generation for issued certificates to the new standard. For more information, see the article "How is the serial number of a certificate formed?„.
  • Perform functional test for the Certification Authority. See article "Perform functional test for a Certification Authority„.
  • Create current backup. See article "Create a backup of a certification authority„.

Related links:

External sources

en_USEnglish
de_DEDeutsch en_USEnglish