SBS 2011 Migration – Moving the SSL over

Posted on by

Migrated SBS 2008 to SBS 2011 and I needed to move the SSL over to the new server (granted it’s expiring in a couple of months).

http://technet.microsoft.com/en-us/library/gg563798.aspx

Move certificates

Self-issued certificates

Migrating self-issued certificates is not supported. Users must transfer the Certificate Distribution Package in the new server to removable media, and then they must re-install the self-issued certificates on the remote computers that are not joined to the domain.

Trusted certificates

If you purchased a trusted certificate, and it is available to export, you can move the certificate to Windows SBS 2011 Standard. To move a certificate, use the following procedures to export it from the Source Server, import it to the Destination Server, and then run the Add a Trusted Certificate Wizard to connect the certificate to Remote Web Access.

To export a trusted certificate from the Source Server

  1. On the Source Server, click Start, click Run, type mmc.exe, and then press ENTER.
  2. On the console, click File, and then click Add/Remove Snap-in.
  3. Click Add, choose Certificates from the list, click Add, and then click OK.
  4. In the pop-up window that appears, click Computer Account, click Finish, and then click OK.
  5. Expand Certificates, expand Personal, and then click Certificates.
  6. Right-click the certificate that is issued to your website (for example: remote.contoso.com), click All Tasks, and then click Export.
    noteNote
    There may be multiple certificates with the same name. Ensure that you choose a certificate that has a valid expiration date and that was issued by a trusted authority. If you are not sure which certificate to use, open Internet Information Services (IIS), determine which certificate IIS is using on the Source Server, and then choose the same certificate.

     

  7. In the Certificate Export Wizard, click Next.
  8. Ensure Yes, export the private key is selected, and then click Next.
  9. Ensure Include all certificates in the certificate path if possible and Export all extended properties are selected, and then click Next. Do not select Delete the private key if the export is successful.
  10. Type a password to protect the certificate file, and then click Next.
  11. Choose a location to save the .pfx file (for example, C:\trustedcert.pfx), and then click Next.
  12. Finish the wizard.

To import the trusted certificate to the Destination Server

  1. Move the trustedcert.pfx file to the Destination Server by using the network or a USB flash drive.
  2. On the Destination Server, click Start, type mmc.exe, and then press ENTER.
  3. On the console, click File, and then click Add/Remove Snap-in.
  4. Choose Certificates from the list, and then click Add.
  5. In the pop-up window that appears, select Computer Account, click Finish, and then click OK.
  6. Expand Certificates, expand Personal, and then click Certificates.
  7. Right-click Certificates, click All Tasks, and then click Import.
  8. On the Certificate Import Wizard Welcome page, click Next.
  9. Browse to the location of the saved .pfx file, and then click Next.
  10. Type the password that you typed in the Export procedure, ensure that Mark this key as exportable and Include all extended properties are selected, and then click Next.
  11. Ensure that the certificate is imported to the Personal folder, and then click Next.
  12. Finish the wizard.

To ensure that the Destination Server is using the newly imported certificate, run the Add a Trusted Certificate Wizard:

To run the Add a Trusted Certificate Wizard

  1. Open the Windows SBS 2011 Standard Console.
  2. On the navigation bar, click the Network tab, and then click Connectivity.
  3. In the task pane, click Add a trusted certificate.
  4. On the Welcome page, read the information, and then click Next.
  5. On the Get the certificate page, click I want to use a certificate that is already installed on the server, and then click Next.
  6. On the Choose an installed certificate page, click the certificate that you just imported, and then click Next.
    noteNote
    If you cannot find the certificate that you just imported in the previous step, double-check whether the Internet address that is configured on the Destination Server is exactly the same as the one on the Source Server.

     

  7. When the wizard finishes, click Finish.
  8. We recommend that you upgrade to a 2048-bit certificate if you were using a 1024-bit certificate.