---
title: "Migrating Private Key from Microsoft AD CS Certificate Authority to Fortanix DSM"
slug: "migrating-private-key-from-microsoft-ad-cs-certificate-authority-to-fortanix-dsm"
updated: 2026-07-27T16:04:45Z
published: 2026-07-27T16:04:45Z
canonical: "support.fortanix.com/migrating-private-key-from-microsoft-ad-cs-certificate-authority-to-fortanix-dsm"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Migrating Private Key from Microsoft AD CS Certificate Authority to Fortanix DSM

## 1.0 Introduction

This article describes how to migrate a private key from an existing **Microsoft Active Directory Certificate Services (AD CS) Certificate Authority (CA)** to **Fortanix-Data-Security-Manager (DSM)**.

## 2.0 Prerequisites

Ensure the following:

- Microsoft Domain Name System (DNS) server role must be enabled and configured for the server.
- Microsoft ADCS server role must be enabled, and the CA must be configured.

## 3.0 Back-Up Existing CA Certificates

Check the certificates that are issued by the existing Windows CA server.

The following figure shows there are five certificates that the CA server has issued so far.

![MSKPI0.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/mskpi0.png)

**Figure 1: Windows CA server certificates**

Perform the followings steps to back up the existing CA certificate:

1. On the Windows Server where Microsoft AD CS role is installed:
  1. Go to **Start**.
  2. Find and run `certsrv.msc`.
  3. Press **Enter** to open the Certification Authority window.

![MSKPI1.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/mskpi1.png)

**Figure 2: Certificate authority**
2. Right-click the CA and in the menu select **All Tasks**→**Back up CA…**

![MSKPI2.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/mskpi2.png)

**Figure 3: Back up CA**
3. In the **Certification Authority Backup Wizard**, click **Next** to choose a location to save the certificate and database.

![MSKPI3.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/mskpi3.png)

**Figure 4: CA backup wizard**
4. Select both the **Private key and CA certificate** and **Certificate database and certificate database log** check boxes.

![MSKPI4.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/mskpi4.png)

**Figure 5: CA backup wizard**
5. Click **Next** to set the password for the private key.
6. Click **Next** again and then click **Finish**.

Now the certificate and database backup will be available in the backup location.

## 4.0 Export the Certificate and Remove it from Trusted Root CA

This section describes the steps to export the CA certificate and remove the AD CS role from the server.

### 4.1 Viewing the Certificates

Perform the following steps to view the certificates of the local computer:

1. Go to **Start**.
2. Find and run `mmc`. Press **Enter**.

![MSKPI5.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/mskpi5.png)

**Figure 6: Run MMC**
3. In the Console window, click the **File** menu, and select **Add/Remove Snap-in**.

![MSKPI6.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/mskpi6.png)

**Figure 7: Add snap-in**
4. From the **Available snap-ins section**, select **Certificates** and click **Add** to configure the certificate.

![MSKPI7.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/mskpi7.png)

**Figure 8: Configure certificate**
5. In the **Certificates snap-in** window, select **Computer account** and click **Next**.

![MSKPI8.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/mskpi8.png)

**Figure 9: Manage certificate for computer account**
6. In the **Select Computer** window, select **Local computer** that the snap-in will manage. Click **Finish**.

![MSKPI9.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/mskpi9.png)

**Figure 10: Select computer**
7. Click **OK** to close the window.

![MSKPI10.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/mskpi10.png)

**Figure 11: Certificate snap-in configured**

Now you will see all the certificates of the local computer.

![MSKPI11.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/mskpi11.png)

**Figure 12: Certificates of local computer**

### 4.2 Exporting the Certificate

Perform the following steps to export the certificate:

1. Under the **Console Root** folder in the left panel, click the folder **Trusted Root Certification Authorities** and click the **Certificates** folder on the right.

![MSKPI26.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/mskpi26.png)

**Figure 13: Trusted root CA certificates**
2. From the available certificates, right-click the **fortanix-server-CA** certificate, and in the menu go to **All Tasks** and click **Export** to export the certificate to a local folder. Remove it from the **Trusted Root Certification Authorities** folder.

![MSKPI12.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/mskpi12.png)

**Figure 14: Export certificate**
3. Under the **Console Root** folder in the left panel, select the **Personal** folder, and delete any available certificates.

### 4.3 Removing AD CS Role from the Server

Perform the following steps to remove the AD CS role:

1. Go to **Server Manager** dashboard.
2. In the top-right menu, click **Manage** and select **Remove Roles and Features**.

![MSKPI13.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/mskpi13.png)

**Figure 15: Remove roles and features**
3. In the **Remove Roles and Features Wizard** screen, select **Server Roles** in the left panel, and clear the check box for **Active Directory Certificate Services** to remove the AD CS role.
4. Click **Next** in the following screens to remove the role and feature.

![MSKPI14.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/mskpi14.png)

**Figure 16: Remove AD CS**
5. Reboot the server.

## 5.0 Configure Fortanix DSM

A Fortanix DSM service must be configured, and the URL must be accessible. To create a Fortanix DSM account and group, refer to the following sections:

### 5.1 Signing Up

To get started with the Fortanix DSM cloud service, you must register an account at <Your_DSM_Service_URL>. For example, [https://amer.smartkey.io.](https://amer.smartkey.io.) On-premises customers use the KMS URL, and the SaaS customers can use the URLs as listed [*here*](https://support.fortanix.com/hc/en-us/articles/4406135346068-Fortanix-DSM-SaaS-Global-Availability-Map) based on the application region.

*For more information on how to set up the Fortanix DSM, refer to the* [*Sign Up for Fortanix Data Security Manager SaaS*](https://support.fortanix.com/docs/users-guide-sign-up-for-fortanix-data-security-manager-saas)*.*

### 5.2 Creating an Account

Access <Your_DSM_Service_URL> in a web browser and enter your credentials to log in to Fortanix DSM.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/DSM_SaaS_Login_page(15).png)

**Figure 17: Logging in**

*For more information on how to set up an account in Fortanix DSM, refer to the* [*Getting Started with Fortanix Data Security Manager - UI*](https://support.fortanix.com/docs/users-guide-getting-started-with-fortanix-data-security-manager-ui)*.*

### 5.3 Creating a Group

Perform the following steps to create a group in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Groups** menu item, and then click **ADD GROUP** to create a new group.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-Group(43).png)

**Figure 18: Add groups**
2. On the **Adding new group** page:
  1. **Title**: Enter a name for your group.
  2. **Description** (optional): Enter a short description of the group.
3. Click **SAVE** to create the new group.

*For more information about groups, refer to* [*Definitions*](/v1/docs/dsm-definitions#40-groups)*.*

> [!NOTE]
> TIP
> 
> It is recommended to configure a **Key undo policy** for groups for the cryptographic keys used by the application before creating or using the keys. Without a configured **Key undo policy**, key deletion is permanent and the deleted key cannot be recovered. Deleting an encryption key may result in permanent loss of access to the protected data and service disruption for applications that depend on the deleted key. *For detailed steps, refer to* [*Key Undo Policy*](/v1/docs/fortanix-dsm-key-undo-policy)*.*

### 5.4 Creating an Application

Perform the following steps to create an application (app) in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Apps** menu item, and then click **ADD APP** to create a new app.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-App(42).png)

**Figure 19: Add application**
2. On the **Adding new app** page:
  1. **App name**: Enter the name for your application.
  2. **ADD DESCRIPTION** (optional): Enter a short description of the application.
  3. **Authentication method**: Select the default **API Key** as the authentication method from the drop down menu. *For more information on these authentication methods, refer to the* [*User's Guide: Authentication*](https://support.fortanix.com/docs/users-guide-authentication)*.*
  4. **Assigning the new app to groups**: Select the group created in [*Section 5.3: Creating a Group*](/v1/docs/migrating-private-key-from-microsoft-ad-cs-certificate-authority-to-fortanix-data-security-manager#53-creating-a-group)[](/v1/docs/using-data-security-manager-with-idcentral-key-management#43-creating-a-group)from the list.
3. Click **SAVE** to add the new application.

*For more information about applications, refer to* [*Definitions*](https://support.fortanix.com/docs/dsm-definitions#50-applications)*.*

### 5.5 Copying the API Key

Perform the following steps to copy the API key from the Fortanix DSM:

1. In the DSM left navigation panel, click the **Apps** menu item, and then click the app created in [*Section 5.4: Creating an Application*](/v1/docs/migrating-private-key-from-microsoft-ad-cs-certificate-authority-to-fortanix-data-security-manager#54-creating-an-application) [](/v1/docs/using-data-security-manager-with-idcentral-key-management#44-creating-an-application)to go to the detailed view of the app.
2. On the **INFO** tab, click **VIEW API KEY DETAILS**.
3. From the **API Key Details** dialog box, copy the **API Key** of the app to be used it later.

## 6.0 Configure Certificate Authority

### 6.1 Importing Key in Fortanix DSM

Perform the following steps to import an RSA key in the Fortanix DSM:

1. Using the command prompt, open the folder where the private key was saved.
2. Using OpenSSL command extract the CA key with `.p12` extension to `.key` and then `rsa` with `.pem`.

![MSKPI15.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/mskpi15.png)
3. In the DSM left navigation panel, click the**Security Objects** menu item, and then click **ADD SECURITY OBJECT** to create a new security object.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-SO(12).png)

**Figure 20: Adding security object**
4. On the**Add new Security Object** page,
  1. **Security Object Name**: Enter the name for your security object.
  2. **Group**: Select the group as created in [*Section 5.3: Creating a Group*](/v1/docs/migrating-private-key-from-microsoft-ad-cs-certificate-authority-to-fortanix-data-security-manager#53-creating-a-group).
  3. Select**IMPORT**.
  4. In the **Choose a type** section, select the **RSA** key type.
  5. In the **Place value here or import from file** section, select the value format type as **Hex**, **Base64**, or **Raw** and click **UPLOAD A FILE** to upload the key file, `CAprivatekey.pem`.
  6. In the **Key operations permitted** section, select the required operations to define the actions that can be performed with the cryptographic keys, such as encryption, decryption, signing, and verifying.
5. Click**IMPORT** to create the new security object.

*For more information about security objects, refer to* [*Definitions*](https://support.fortanix.com/docs/dsm-definitions#60-security-objects)*.*
6. Install Microsoft CNG Key Storage Provider by following the article [*here*](/v1/docs/clients-microsoft-cng-key-storage-provider)and run the following commands:

![MSKPI27.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/mskpi27.png)

You will see activity logs similar to **Figure 21**.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/MicrosoftADCS-1(1).png)

**Figure 21: App authentication activity logs**

### 6.2 Installing X.509 Certificate in Local User Trusted Root CA Store

Perform the following steps to install the X.509 certificate that was exported in [*Section 4.2: Export the Certificate*](/v1/docs/migrating-private-key-from-microsoft-ad-cs-certificate-authority-to-fortanix-data-security-manager#42-export-the-certificate) in the local user Trusted Root CA store:

1. Right-click the certificate and click **Install**.
2. Click **Next**.

![MSKPI16_1.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/mskpi16_1.png)

**Figure 22: Install certificate**
3. Select **Place all certificates in the following store** and click **Browse**.
4. Select **Trusted Root Certification Authorities** and click **Ok**.

![MSKPI30.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/mskpi30.png)

**Figure 23: Select certificate store**
5. Click **Next**.
6. Click **Finish**.
7. Click **Ok** to close the import success message.
8. You will now see the certificate, that is, `fortanix-server-CA` has been successfully imported in the Trusted Root CA.

### 6.3 Installing CA Certificate in the Personal Store

Perform the following steps to install the certificate into your store:

1. Run the following command from the command prompt terminal:

```bash
certutil -addstore my <certificate name>
```

![MSKPI17.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/mskpi17.png)Where, `fortanix-server.CA` is the exported certificate in Base-64 encoded X.509 (`.CER`)
2. Once you run the command above, you can find the exported CA in the Personal Trust Store:

![MSKPI18.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/mskpi18.png)

**Figure 24: CA installed in personal trust store**
3. Run the following command to find the cert serial number:

```bash
certutil -store my
```

![MSKPI19.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/mskpi19.png)
4. Run the following command to repair the certificate store:

```bash
certutil -f -repairstore -csp "Fortanix KMS CNG Provider" my "<cert serial number>"
```

The repair operation will not be allowed because the private key is restricted from being exported from Fortanix DSM, protecting the key integrity.

![MSKPI20.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/mskpi20.png)

### 6.4 Adding AD CS Role to the Server

Perform the following steps to add the AD CS role to the server:

![MSKPI21.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/mskpi21.png)

**Figure 25: Add AD CS role**

1. In the **Private Key** window, select **Use existing private key** and then select **Select a certificate and use its associated private key**.

![MSKPI22.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/mskpi22.png)

**Figure 26: Configure AD CS**
2. In the **Existing Certificate** window, the imported certificate is shown. Select the certificate and select **Allow administrator interaction when the private key is accessed by the CA**.

![MSKPI23.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/mskpi23.png)

**Figure 27: Configure AD CS**
3. In the **Certificate Database** window, click **Next**.
4. In the **Confirmation** window, click **Configure**.

![MSKPI24.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/mskpi24.png)

**Figure 28: AD CS configuration**
5. When the CA installation is complete, click **Close** in the installation results window. You can find the CA configured.

![MSKPI31.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/mskpi31.png)

**Figure 29: CA configured**
6. Once the CA certificate is successfully configured, you can then check the Fortanix DSM Certificate logs.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (1680).png)

**Figure 30: Certificate logs**
7. To test the operation, request a certificate from a client machine.

![MSKPI33.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/mskpi33.png)

**Figure 31: Request a certificate**
8. Use the Certificate Enrollment Web service to request a certificate from a client machine, fill in all the details in the form and click **Submit**.

![MSKPI34.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/mskpi34.png)

**Figure 32: Request a certificate**
9. Once the certificate is issued, click **Install this certificate**.

![MSKPI35.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/mskpi35.png)

**Figure 33: Certificate issued**
10. Now go back to the CA server to see if the Certificate is issued and use the mmc console again.

![MSKPI36.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/mskpi36.png)

**Figure 34: Certificate installed**

## 7.0 Restore Issued Certificates

Perform the following steps to restore the certificates:

1. Go to the Certificate Authority (CA) service and right-click the CA.
2. In the menu, click **All Tasks**→**Restore CA**.

![CA_Restoration.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/ca_restoration.png)

**Figure 35: Restore CA**
3. In the **Certification Authority Restore Wizard**, click **OK** to stop the Active Directory Certificate Services.

![Stop_certificate_service.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/stop_certificate_service.png)

**Figure 36: Stop active directory certificate services**
4. Click **Next**.

![Next.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/next.png)

**Figure 37: CA restore wizard**
5. In the **Items to Restore** section, select **Certificate database and certificate database log**. Enter **C:\** directory as the restore location. Click **Next**.

![Itemstorestore.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/itemstorestore.png)

**Figure 38: Items to restore**
6. Click **Finish** to close the wizard and begin the restoration process.

![Finish.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/finish.png)

**Figure 39: Begin restoration**
7. The CA restoration is completed. Click **Yes** to start Active Directory Certificate Services.

![RestoreComplete.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/restorecomplete.png)

**Figure 40: Restoration complete**
8. The SubCA certificate is restored.

![SubCV_certificate.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/subcv_certificate.png)

**Figure 41: Certificate restored**

Any previously issued certificates will be listed.

Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.

## Related

- [Security Objects Tokenization](/fortanix-dsm-security-objects-tokenization.md)
- [Terraform Provider](/fortanix-dsm-clients-terraform-provider.md)
- [Fortanix DSM for Google Workspace Client-Side Encryption](/fortanix-dsm-for-google-workspace-client-side-encryption.md)
- [Installation on VMware](/fortanix-data-security-manager-installation-on-vmware.md)