You can perform Certificate Authority maintenance operations on your Certificate Authority servers in three different stages according to your needs. Regular maintenance ensures better performance and security for your Certificate Authority system.
- Certificate Authority Backup
- Certificate Authority Transaction Log Truncate
- Certificate Authority Database Defrag
Certificate Authority Backup
If your backup application supports taking a dedicated backup for the Certificate Authority, you can proceed accordingly.
The method described here is related to backing up the Certificate Authority environment without third-party applications.
Exporting Certificate Authority Registry Values: Export the Certificate Authority registry values from both the “CertSvc” directory and the “Configuration” directory to ensure proper backup.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc
The registry contains configuration information related to the Certificate Authority.
Initiating the Backup Process: After exporting the registry, start the backup process from the Certificate Authority console.
Backup Selection: Select “Private key and CA certificate” and “Certificate database and certificate log”, then specify the backup path before proceeding.
Certificate Authority Transaction Log Truncate
When you check the Certificate Authority directory, you will see log files generated by the Certificate Authority.
You can view the database and log files of the Certificate Authority by running the following command in the command prompt:
certutil -databaselocations
Depending on the usage of the Certificate Authority, these log files may accumulate in large numbers and cause disk space issues.
To truncate these log files, simply take a backup through the Certificate Authority console.
Automatic Log Truncation: Completing the backup process automatically truncates the logs.
Certificate Authority Database Defrag
Certificate Authority Database: The Certificate Authority server stores certificates and configurations in a .edb database file.
This database can grow in size depending on the status of the certificates in your environment (revoked, issued, pending, failed) and templates.
As the database size increases, the backup process will take longer. Therefore, it is important to monitor the database size.
Defragmentation Requirement: If the database size increases significantly, run a defragmentation process to optimize performance.
To perform a defrag operation, follow these steps:
- Stop the CA service
You can do this through the Certificate Authority console or by running the following command in Command Prompt (Run as Administrator)
net stop certsvc
- Run the defrag operation
Execute the following command in Command Prompt (Run as Administrator)
esentutl /d "FULL-PATH-TO-EDB-FILE"
The duration of the defragmentation process will vary depending on the database size.
- Restart the CA service
Restarting the CA Service: After completing the defragmentation, restart the CA service to apply changes.
net start certsvc