How to decommission an old Root CA and Issuing CA after the new ones are already in live

Question

I wanted to remove or decommission the old Root CA and the issuing CA. Already have the new Root CA and the issuing CA. Wanted to know the step by step process how to check the live certificates in the old CAs and then decommission them.

Answer 1

Hello Vishnu Priya,

Thank you for posting in Q&A forum.

You can check all the certificates issued by CA in the "Issued Certificates" container on both root CA server and issuing CA server\ Certification Authority console (below).

And you can also check if you set up certificates autoenrollment via GPO.

For more information, please refer to links below.

https://www.vkernel.ro/blog/set-up-automatic-certificate-enrollment-autoenroll

https://learn.microsoft.com/en-gb/troubleshoot/windows-server/certificates-and-public-key-infrastructure-pki/decommission-enterprise-certification-authority-and-remove-objects

I hope the information above is helpful.

If you have any questions or concerns, please feel free to let us know.

Best Regards,

Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.