How to Back Up an Active Directory Certificate Services CA
Applies to: Windows Server 2019, 2022 and 2025.
A CA backup must include private key, CA certificate, database and configuration. Protect it as strongly as the live CA.
PKI changes affect trust across the organization. Use an approved certificate policy, offline backups and separation of duties. Visit networkmanager.info.
Prerequisites
- Use encrypted restricted storage.
- Choose a strong one-time backup password.
- Record registry configuration.
- Plan an isolated restore test.
Procedure
Step 1: Create location
Use protected storage.
New-Item -ItemType Directory -Path 'E:\CA-Backup' -ForceStep 2: Back up CA
Run certutil and enter password interactively.
certutil -backup E:\CA-BackupStep 3: Export configuration
Capture CA registry settings.
reg export HKLM\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration E:\CA-Backup\CA-Configuration.reg /yStep 4: Create hashes
Record integrity.
Get-ChildItem E:\CA-Backup -File -Recurse | Get-FileHash -Algorithm SHA256Step 5: Store offline copy
Separate it from the online CA and daily credentials.
Verification
Review contents and perform an isolated restore rehearsal.
Get-ChildItem E:\CA-Backup -Recurse
Get-ChildItem E:\CA-Backup -File -Recurse | Get-FileHash -Algorithm SHA256Rollback and recovery
Backup is non-destructive. If written to a wrong location, secure or destroy the misplaced copy under the approved media process.
Security notes
Possession of the private key and backup password can permit CA impersonation; use dual control and auditing.
Official references
Explore Netcloud24 Canada.
