Phase 8: Old CA Decommissioning
The old CA is decommissioned only after the customer and EC confirm that its issuance role has ended and its remaining certificate validation obligations are addressed. Shutting down a CA does not remove the need for relying parties to validate certificates it previously issued.
Key activities
- Stop new certificate issuance through the old CA and remove or disable obsolete enrollment paths under an approved change. Check issuance records for unexpected requests after cutover.
- Reconcile the certificate inventory with application owners. Replace remaining certificates where required or document any approved exceptions and their dependencies.
- Determine how the old CA certificates, AIA locations, and CRLs will remain available for any outstanding certificates. Confirm the publication and retention period before stopping CA services or removing directory objects.
- Back up the old CA database, configuration, certificates, audit logs, and recovery material according to the customer's retention policy. Record the final operational state and the party responsible for retained repositories.
- Remove old CA services, templates, AD objects, and server infrastructure only in the approved sequence. Validate authentication, application behavior, chain building, and revocation checking after each removal step.
Phase outcome
When this phase is complete, the old PKI has been retired in a controlled way without breaking any system that still relies on it. The old CA no longer issues certificates and its enrollment paths have been removed. Certificates it issued that are still in use have either been replaced or documented as approved exceptions, and the old CA certificates, AIA locations and CRLs remain published for as long as those certificates must be validated. The CA database, configuration, audit logs and recovery material are backed up under the customer's retention policy, with a named owner for the retained records. The old servers, templates and directory objects are removed in the approved order, with authentication and applications checked after each step, leaving PKIaaS as the customer's single PKI.