Phase 6: Certificate Migration
Certificates are migrated in planned groups rather than all at once. The sequence is based on operational criticality, certificate expiry, enrollment complexity, and application dependencies. The existing PKI continues to support certificates that have not yet been replaced.
Key activities
- Agree on the migration method for each certificate category. For example, Windows computers may use auto-enrollment, web servers may use a CSR and manual installation, and network devices may use SCEP or a managed deployment process.
- Migrate a small pilot group first. Install PKIaaS certificates and verify their subject names, SANs, EKUs, chain, revocation status, and intended application behavior.
- Move remaining certificates in scheduled waves. For each system, record the old certificate, new certificate, owner, installation location, application binding, validation result, and date of migration.
- Update Group Policy, template assignments, application configurations, and enrollment workflows only for the groups scheduled to migrate. Where a certificate must be changed on a load balancer, web server, or other shared service, coordinate the change with its application owner.
- Validate renewal and replacement behavior, not only initial issuance. Check that new requests are reaching the PKIaaS Issuing CA and that certificates are not unexpectedly being issued by the existing CA.
- Investigate failed requests or application errors before proceeding to the next wave. Keep the old certificate and configuration available for rollback until the new certificate has passed the agreed observation period.
Phase outcome
When this phase is complete, the certificates in each scheduled group have been replaced with certificates issued by PKIaaS. Every new certificate has been checked for the correct names, SANs, EKUs, chain and revocation status, and the applications that use it have been confirmed to work as expected. Renewal has been tested as well as first issuance, so the new certificates continue to renew from PKIaaS without manual effort. Each change is recorded in the migration tracker with the old and new certificate, the owner, the location and the validation result, which gives a complete audit trail. The old certificates and configurations remain available for rollback until each group has passed its observation period.