AD CS Offline Root CA Cryptographic Service Provider (CSP) Selection Lockout

Snake,Luv, Mushroom 40 Reputation points
2026-09-14T16:14:34.1366667+00:00

Upgrading an offline Root CA to SHA-256 fails because the underlying key was generated using a legacy CSP instead of a KSP. How do we migrate Root CA private keys from CSP to Key Storage Provider (KSP)?

Windows for business | Windows 365 Business
0 comments
Answer accepted by question author
Tracy Le 12,650 Reputation points Independent Advisor
2026-09-14T17:07:57.88+00:00

Hello Snake,Luv, Mushroom,

Migrating a Root CA private key from a legacy CryptoAPI Cryptographic Service Provider to a CNG Key Storage Provider requires updating the key container and modifying the CA registry configuration. Before proceeding, back up your CA certificate and private key using certutil -backupkey.

Stop Active Directory Certificate Services by running net stop certsvc. Next, import the private key into CNG by executing certutil -csp "Microsoft Software Key Storage Provider" -importpfx RootCAKey.pfx. Once imported, update the CA configuration in the registry under HKLM:\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\YourCAName by changing the Provider value to Microsoft Software Key Storage Provider and ensuring the HashAlgorithm is set to SHA256.

Start the service with net start certsvc and verify health by running certutil -cainfo. If this guidance successfully resolves your KSP migration issue, please accept the answer.

Tracy Le.

Was this answer helpful?

1 person found this answer helpful.
0 comments

0 additional answers

Sort by: Newest
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.