I have created a clone of our offline root CA in order to play around with. I successfully migrated the clone from CSP to KSP. Now I am testing renewing the CA certificate and following the guidance in the following links:
http://technet.microsoft.com/en-us/library/cc780374%28v=ws.10%29.aspx
https://www.youtube.com/watch?v=Q-1Y1ZI9R6k
I'm experiencing an issue when renewing the CA certificate (both with and without generating a new key pair). After the Certification Authority services stop, I get the following error:
"Cannot create file \\<Root_CA_hostname>\CertConfig\<Root_CA_hostname>_<Root_CA_name>.crt: The network name cannot be found. 0x80070043 (WIN32: 67 ERROR_BAD_NET_NAME)"
Even though I receive this error, it appears the certificate is, in fact, renewed. I see a new CRT file in C:\Windows\System32\CertSvc\CertEnroll\ and the CRL file has a new timestamp. The new certificate also appears in the Certificates MMC
snap-in as well as the properties of the CA itself.
I noticed that the folder C:\Windows\System32\CertSvc\CertConfig\ does not exist on the system. I created it and shared it and tried renewing the certificate again and this time I did not get the error. A CRT file was created in the CertConfig
folder.
Both the offline root CA and online, domain-joined issuing CA are running Windows Server 2012 R2. They were both previously migrated from servers running Windows Server 2003 R2. I do not know what procedures were followed for the migration as
someone else performed it that is not here at this time. According to the following link, the CertConfig folder is deprecated and is not longer created when you set up Active Directory Certificate Services on newer operating systems (unless you do it
via PowerShell):
https://social.technet.microsoft.com/Forums/en-US/18f3822f-6a8c-404a-ac4f-ff084b715909/pki-install-issue?forum=winserversecurity
I did look in the registry on the root CA and I see, under the key containing the root CA settings, a string "CACertFileName" that has a value of "\\<Root_CA_hostname>\CertConfig\%1_%3%4.crt". I imagine that has something
to do with the error I am receiving.
I also looked at the registry on the online, domain-joined issuing CA and it does not have a "CACertFileName" string in the registry under the key containing the issuing CA settings.
Can the error I am receiving when renewing the root CA certificate on the test machine be safely ignored? Should the value for "CACertFileName" on the root CA be set to something else? Should it be deleted entirely?
Thank you in advance.