Microsoft AD CS to Cloud PKI Migration Services

Vendor-neutral Microsoft PKI consultancy. We migrate legacy Active Directory Certificate Services (AD CS) to a modern Hybrid PKI with new cloud issuing CAs on Azure, AWS, or Google Cloud while retaining on-prem issuing CAs for legacy endpoints and extending compliant governance to cloud consumers and service mesh infrastructure.

Book a migration assessment →

AD CS Migration: Modernize Legacy Microsoft PKI Without Breaking On-Prem

Enterprises running AD CS (2008/2012/2016/2019/2022) must keep Windows autoenrollment, NDES/SCEP, GPO-based enrolment, and legacy TLS/Code Signing while onboarding cloud workloads, containers, and service mesh mTLS.

SafeCipher designs a phased Hybrid PKI that maintains uptime in data centers and factories and introduces cloud CAs for modern consumers.

  • Zero-downtime coexistence: parallel chains, cross-certification, staged issuance.
  • Governance & policy: CP/CPS refresh, algorithm agility, issuance policies.
  • Key protection: HSM/Managed HSM, BYOK/HYOK, FIPS 140 validated modules.

Azure: Managed HSM & Certificate Services

  • Azure Key Vault Managed HSM for CA private keys; Key Vault for secrets/certs.
  • Integrations: Intune, Entra ID, Defender for Cloud/IoT.
  • Enrolment: ACME, EST, SCEP/NDES.

AWS: ACM Private CA & AWS KMS/CloudHSM

  • AWS ACM Private CA for cloud issuing; KMS/CloudHSM for key custody.
  • Consumers: EKS, EC2, IoT Core, App Mesh mTLS.
  • Controls: IAM, Organizations SCPs, Private CA policy.

Google Cloud: Certificate Authority Service (CAS) & Cloud KMS/HSM

  • CAS as cloud issuing; Cloud KMS/HSM for keys.
  • Consumers: GKE, Compute Engine, Anthos, service mesh mTLS.
  • Controls: Organization policy, Workload Identity, fleet governance.

Retain On-Prem AD CS Issuing CAs for Legacy Endpoints

Keep existing autoenrollment, NDES, smartcard/Logon, 802.1X, VPN, and server auth templates working while onboarding cloud consumers.

  • Template redesign and permissions (security descriptors, issuance policies).
  • Hardened CRL/OCSP publication and HA responders.
  • GPO scoping, enrolment hygiene, deprecate weak algorithms (e.g., SHA-1).

Hybrid PKI Topology Patterns: Subordination, Cross-Certs & Bridge

  • Select the right trust pattern for your risk, compliance, and operational constraints.
  • Cloud-subordinate issuing CA chained to existing on-prem Root/Policy CAs.
  • Cross-certification to enable safe staged migration.
  • Bridge/Policy CA for multi-forest or multi-cloud trust harmonization.

Service Mesh mTLS & Workload Identity (Istio, Linkerd, Consul, Kuma, Cilium)

Extend Microsoft PKI trust into cloud-native platforms. We implement workload identities and mTLS using SPIFFE/SPIRE or ACME/EST with short-lived certificates, anchored to your corporate PKI.

  • North-south & east-west TLS policies with automated rotation.
  • Federated identity across clusters/regions and multi-cloud.
  • Revocation and observability integrated with SIEM/SOAR.

Cryptography Baselines, HSM Ceremonies & Algorithm Agility

We run Root Key Generation (RKG) ceremonies, protect keys in HSMs/Managed HSMs, and document chain-of-custody. Baselines include RSA-3072/4096, P-256/P-384, and staged post-quantum hybrids where appropriate.

  • Split-knowledge/M-of-N, escrow and backup policies.
  • Code signing, secure boot, device identity for IoT/OT.
  • PQC pilots that don’t break legacy stacks.

Enrolment Protocols: Autoenrollment, SCEP/NDES, EST & ACME

  • Windows autoenrollment & GPO for domain-joined clients and servers.
  • NDES/SCEP modernization for devices, MDM/Intune, network gear.
  • EST/ACME for Kubernetes, containers, and service mesh workloads.

Operations: Monitoring, CRL/OCSP, Compliance & Audit

  • HA OCSP, delta CRL, resilient CDP/AIA publication points.
  • Certificate lifecycle KPIs, expiry SLOs, alerting (SIEM/SOAR).
  • Evidence for ISO/IEC 27001, PCI DSS, SOX, NIS2, IEC 62443.

Our Migration Process: Assess → Design → Pilot → Cutover

  • Discovery & Assessment: inventory CAs, templates, CDPs/AIA, keys, consumers.
  • Target Architecture: trust model, cloud CA choice, HSM model, enrolment flows, governance.
  • Pilot & Hardening: prove issuance to cloud/mesh; validate CRL/OCSP, policies, monitoring.
  • Staged Cutover: phased migration, retire weak templates, update GPOs, finalize runbooks.

Microsoft AD CS to Cloud PKI Migration FAQs

Can we keep our on-prem issuing CAs while adding cloud issuing CAs?

Yes. We build a Hybrid PKI where on-prem issuing CAs continue serving legacy endpoints while cloud issuing CAs serve modern workloads. Trust is maintained via subordination or cross-certification.

How do we prevent outages during migration?

Staged enrolment, parallel chains, strict testing, conservative TTLs, and intact legacy CRL/OCSP until new paths are widely trusted and monitored.

Which cloud CA should we choose?

Azure (Key Vault/Managed HSM), AWS (ACM Private CA), and Google (CAS) all work. Selection depends on key custody, integration, cost, and controls – we are vendor-neutral.

Can we integrate with service mesh and SPIFFE/SPIRE?

Yes. We implement SPIFFE IDs and automated short-lived cert issuance anchored to your corporate PKI, enabling mTLS across clusters and clouds.

Will we meet compliance requirements?

We align CP/CPS, operations, and evidence with ISO 27001, PCI DSS, SOX, NIS2, and IEC 62443, plus sector mandates.

Related PKI & Security Services

Talk to SafeCipher

Ready to modernize Microsoft AD CS and extend compliant PKI to cloud consumers and service mesh? Our specialists will map a no-downtime Hybrid PKI path.