Exchange 2000 Key Management Server Migration to a Windows 2003 CA


This article is based on Windows 2003 Enterprise Edition (Build 3790) and Exchange 2000 Enterprise Service Pack 3. Reference:  Exchange 2000 Online help.


Introduction


Exchange 2000 Administrators must use the Key Management Server database to offer secure e-mail services for Exchange users with Outlook Clients.


Windows 2000 offers its own Public Key Infrastructure (PKI) which provides services to issue certificates (e-mail certificates, EFS-certificates and so on).


You as an Administrator have to manage both services which are more time intensive.


With Exchange 2003 there is no separate Key Management Database. Exchange 2003 uses the Windows 2003 Enterprise CA capabilities to offer secure e-mail services.


Export of the Exchange 2000 KMS database


Before we export the KMS database we have to import a certificate from the Windows Server 2003 CA which will be used to encrypt the exported KMS database. The steps to export a certificate from a Windows 2003 CA and to import this certificate into the certificate store of the Exchange Server are not part of this article.


To start the export – Start Exchange System Manager and go to “Advanced Security” – Key Manager and select “All Tasks” – “Export Users”




Figure 1: Export the KMS users in Exchange 2000 System Manager


Browse the path to the exported Windows 2003 CA certificate. This certificate is used to encrypt the exported KMS database.




Figure 2: Specify the exported Windows Server 2003 certificate


For security reasons enter the first eight characters from the thumbprint from the Windows 2003 CA certificate.




Figure 3: Enter the first eight characters of the thumbprint


Specify the name of the file for the exported KMS database. The default path is \EXCHSRVR\KMSDATA




Figure 4: Enter the name of the export file


Select the users to export from the KMS database




Figure 5: Export the KMS users in Exchange 2000 System Manager


Congratulations: You have successfully exported the selected users.




Figure 6: See the process of exporting the users


Import of the exported KMS database from KMS to Windows 2003 CA


Before we can import the KMS database into the Windows 2003 CA store, we must enable the Windows 2003 CA to archive private keys. To do this we have to issue a Key Recovery Agent certificate for the account used to migrate the KMS database and to enable key archiving under “Recovery Agents” in the Certificate Authority SnapIn.


The high level steps to this are:



  • Issue a “Key Recovery Agent” certificate Template (Start – All Programs – Administrative Tools – Certification Authority – Certificate Templates – New – “Certificate template to issue”)
  • Create a custom MMC – and add the Certificate SnapIn for the User Account that will migrate the KMS database
  • Specify the Key Recovery Agent certificate under the properties of the Certificate Authority under “Recovery Agents”.

Enable the CA for foreign key import


Before we can import the KMS database into the certificate store of the Windows 2003 CA we have to allow the import of foreign certificates.




Figure 7: Enable the CA to import foreign certificates


Now we have to import the exported KMS database with CERTUTIL:




Figure 8: Import the exported KMS database


Select the certificate which we have used to export the KMS database




Figure 9: Select the certificate to encrypt the database


Import the KMS database into the Windows 2003 CA with CERTUTIL




Figure 10: Import the KMS database


Key recovery


Run the Tool KRT.EXE from the Windows Server 2003 Resource Kit to perform a GUI recover of the selected certificate. You have to specify the serial number of the certificate in the Value field to recover the certificate. Next click “Recover” to recover the certificate




Figure 11: The Key Recovery Tool (KRT)


Choose the path to save the file and select a password to protect the recovered .PFX file. The Prefix .PFX shows that the private key is included in this file.




Figure 12: Specify the path to the .PFX file


Congratulations. You have successfully recovered the certificate.




Figure 13: Import the exported KMS database


Conclusion


The integration of the Key Management Services from Exchange 2000 into the Windows 2003 Enterprise CA is the next logical step for the Exchange 2003 deployment. With this constellation you can use the full power of the Windows 2003 Enterprise CA.


Related Links


Microsoft Exchange 2003 Homepage
http://www.microsoft.com/exchange


Windows 2003 Homepage
http://www.microsoft.com/windows2003

Leave a Comment

Your email address will not be published.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Scroll to Top