Microsoft AD CS Migration
Migrate from legacy or misconfigured AD CS infrastructure to a modern, properly architected PKI. Parallel operation during transition ensures zero disruption. Phased certificate migration with rollback capability at every step.
Request a Quote
Typical engagement: 4-8 weeks
What You Get
Current state assessment (full AD CS audit)
Target architecture design addressing all identified gaps
Migration plan (phased approach with dependencies and rollback)
New PKI deployment (Root CA + Issuing CA built alongside existing)
Certificate migration (templates, auto-enrollment, re-issuance)
Parallel operation period (both old and new running)
Decommission plan for retiring old CAs
Updated documentation (runbooks, CP/CPS, procedures)
How It Works
1
Assessment
Week 1-2Audit existing PKI, document current state, identify risks
2
Design
Week 2-3Target architecture, migration strategy, risk mitigation
3
Build New PKI
Week 3-5Deploy new hierarchy alongside existing
4
Migrate
Week 5-7Phase certificate templates, auto-enrollment, client certs
5
Validate
Week 7-8Parallel operation, verify all services using new certs
6
Decommission
Week 8+Retire old CAs once fully validated
Typical Scope & Duration
| Scope | Duration |
|---|---|
| Single CA migration, simple environment | 4-6 weeks |
| Multi-CA, complex environment | 6-8 weeks |
| Cross-forest / large enterprise | 8-12 weeks |
Who This Is For
- Organizations running outdated AD CS (Server 2008/2012)
- Companies with 1-Tier PKI needing proper 2-Tier separation
- Teams that inherited broken/undocumented PKI
- Organizations with compliance findings about their PKI
- Companies consolidating after M&A (multiple PKIs to unify)
What Happens Next
CLM platform deployment for the new PKI
Ongoing monitoring and health assessments
Certificate automation and lifecycle management
Ready to Get Started?
Schedule a free scoping call. We'll understand your environment and provide a clear proposal with scope, timeline, and pricing.