Migrating from MS ADCS to AVX Native CA

The ADCS Migration utility provides a guided and structured workflow to migrate Microsoft Certificate Authority (MSCA/ADCS) configurations to AppViewX Native PKI . The process begins with pre-validation and permission checks, followed by discovery of active MSCA instances. Administrators can then select a source CA and map it to a corresponding AppViewX PKI CA. The system retrieves AD-published certificate templates, extracts key attributes such as EKU and KU, and creates equivalent templates in AppViewX. The entire workflow is designed to be secure, auditable, and resilient, with clear progress tracking, validation checkpoints, and rollback guidance.
Note: Migrating from MS ADCS to AppViewX Native CA is not supported in a Managed Kubernetes environment. To perform this migration, use an AppViewX deployment that is not running in Managed Kubernetes.

Network Prerequisite: Communication

Port Protocol Direction From To Purpose
135 TCP Inbound/ Outbound Autoenrollment Server Machine All Windows machines in the domain RPC Endpoint Mapper
49152–65535 TCP Inbound/ Outbound Autoenrollment Server Machine All Windows machines in the domain RPC Dynamic Ports
30020 / 31443 / Custom LB Port TCP Outbound Autoenrollment Server Machine CC / AppViewX / Load Balancer Communication with AppViewX
3268 / Custom Global Catalog Port TCP Inbound CC / AppViewX Active Directory (AD) Fetch SAN / Certificate details

Migration Overview

Migrate the existing Certificate Authority (CA) to AppViewX Native PKI without impacting other applications or endpoints. This guided flow helps to create parallel AppViewX CA, route enrollment seamlessly, and complete the migration with full visibility and control.

To start the migration,

  1. Go to Menu > PKI > CA Migration.
    The Migration Overview page is displayed.
  2. Select MSCA (ADCS).
    Note: This option is currently enabled only for migration of MSCA (ADCS). The AppViewX Standard CA and EJBCA options are disabled.
  3. Click Start Migration.

Migration History

AppViewX preserves migration records on the CA Migration landing page. You can review the outcome, configuration, and audit details of past migration runs across different Certificate Authorities (CAs) at any time without rerunning the migration journey.
Note: In-progress migrations also appear as active cards at the top of the landing page, providing direct Resume and Discard options.
Any migration that is currently in progress appears as a card at the top of the CA Migration page. Each card provides the following actions:
  • Resume: Continue the migration from where it was paused or interrupted. Selecting Resume opens the wizard at the last saved step.
  • Discard: Permanently cancel the migration. When you select Discard, AppViewX displays a confirmation message. If confirmed, AppViewX removes all resources created during that migration run (such as PKI templates, certificate groups, and WAEP agent configurations). Pending migration steps are marked as Discarded.
In the Migration History table, locate the migration record you want to review.
Table 1. View Migration history details
Column Description
Migration Name The unique identifier assigned to the migration run.
Certificate Authority The name of the source Microsoft Certificate Authority (MSCA).
Status The current or final state of the migration:
  • In Progress: The migration is actively running or paused.
  • Completed: The migration finished successfully with all CA mappings, template translations, and enrollment configurations applied.
  • Partially Completed: The migration finished CA and template mappings, but optional advanced configurations (such as WAEP agent setup) were skipped.
  • Discarded: The migration was abandoned, and AppViewX-generated artifacts were removed.
Date The timestamp when the migration was last updated or completed.
Action Options to interact with the migration record.
Select View Details to open the Migration Summary pane. The pane shows a quick overview of the migration run, including:
  • Total CAs Migrated: Number of source Microsoft CAs mapped to AppViewX PKI CAs.
  • Templates Created: Number of equivalent AppViewX PKI certificate templates generated.
  • Steps Breakdown: Count of steps that were completed, skipped, or discarded.
  • Status: The overall migration status.
  • Execution Summary: Log notes and descriptive details for the run.
Click a step entry to expand a dropdown displaying detailed information for that step.
Note: The View Full Report option is not available for migrations with a Discarded status.
Review migration summary
Selecting View Details in the Action column opens the Migration Summary pane on the right side of the screen. The summary pane includes:
  • Migration Status: Displays the overall status (Completed, Partially Completed, or Discarded).
  • CAs Migrated: The total count of source root and subordinate CAs mapped to AppViewX PKI CAs.
  • Templates Created: The number of equivalent AppViewX PKI certificate templates generated.
  • Step Progress: A summary count of completed, skipped, and discarded steps in the migration journey.
  • Execution Summary: Operational summary and log notes for the migration run.
  • Step Details: Select any individual step to expand its dropdown and inspect detailed step-level execution details.

View full migration report

To review the complete end-to-end migration configuration, select View Full Report at the bottom of the Migration Summary pane.
Note: The View Full Report option is not available for migrations with a Discarded status.
The full migration report provides detailed configuration tables across all migration stages:
  • Source and Destination CA Details: Displays the source MSCA hierarchy, target AppViewX Native CAs, and CA mapping associations.
  • Template Mappings: Lists discovered ADCS templates, target AppViewX templates, and template creation statuses.
  • Issuer and Group Mappings: Details mapped CA issuers, certificate groups, and assigned permissions.
  • WAEP Configuration: Shows Windows Auto-Enrollment Protocol endpoint details, FQDN or IP addresses, and configured port numbers.
  • LDAP Configuration: Displays Active Directory and Global Catalog settings (with sensitive credentials and secrets masked).
  • Enrollment Server Details: Shows enrollment server host information, registration parameters, and backend script execution logs.

Select Migration Type

When you start migrating from Active Directory Certificate Services (ADCS) to AppViewX Native PKI, choose the migration path that fits your infrastructure needs. Your choice determines the required permissions, whether templates are cloned in Active Directory, and which components are configured during the wizard.
AppViewX offers two migration paths:
  • Comprehensive PKI Migration: An end-to-end migration path that clones Active Directory templates, validates enterprise-level permissions, and sets up automated certificate enrollment (WAEP and Enrollment Server).
  • Standard PKI Migration: A lightweight, read-only migration path that discovers and maps existing templates into AppViewX without modifying Active Directory or deploying enrollment agents.
Note: After you select a migration path and click Continue, your choice is saved for the migration instance and cannot be changed.

Migration workflows

Review the step-by-step workflow for each path:
  • Comprehensive PKI Migration workflow (8 steps):
    1. Select Comprehensive PKI Migration and click Continue.
    2. Download and deploy the Windows Gateway.
    3. Validate domain and enterprise administrative permissions.
    4. Map the source Microsoft CA to AppViewX Native PKI.
    5. Review the discovered templates.
    6. Configure and clone templates in Active Directory with the AVX_ prefix.
    7. Configure Windows Auto-Enrollment Proxy (WAEP) settings.
    8. Download, install, and configure the AppViewX Enrollment Server.
  • Standard PKI Migration workflow (6 steps):
    1. Select Standard PKI Migration and click Continue.
    2. Download and deploy the Windows Gateway.
    3. Validate network connectivity (admin permission checks are skipped).
    4. Map the source Microsoft CA to AppViewX Native PKI.
    5. Review the discovered templates in read-only mode.
    6. Map the discovered templates to AppViewX templates and click Finish.

Download Windows Gateway

Windows Gateway acts as a secure communication bridge between AppViewX and Windows endpoints. As part of the guided migration process, first download and deploy the Windows Gateway. Provide the required configuration details to download the package, including the target datacenter, Windows hostname (FQDN), client certificate (PFX/P12), and the authentication method or credentials configured in AppViewX. Follow the steps below.
Note: Enterprise Admin and Domain Admin permissions are required to proceed with the migration.

Steps:

  1. Click Download Gateway to download the windows gateway package to the local machine. (Download and install the package before validating the connection.)
  2. Enter the fields as follows:
    Fields Description
    Gateway Setup
    Migration Name Enter a user-friendly name (maximum16-characters) to identify the migration. This name will be used in the WAEP agent configuration and template creating within AppViewX. :
    Note:
    • The migration name specified here will be used as a suffix when creating the AppViewX equivalent Template
    • The new WAEP agent settings will also be created with the same migration name.
    Server Configuration
    *Select Data Center Select the desired data centre to establish the connection.
    *Hostname Enter the hostname or FQDN where the Windows Gateway will be installed. Provide a fully qualified domain name only.
    *Port Enter the port number from which the Windows Gateway service listens. Default port is 8999, but a custom port can be provided if needed.
    Authentication Credentials
    *Authentication Select the authentication type to access the windows gateway machine:
    • Manual
    • Credential List - Appviewx
    *Username This field is enabled when the Authentication = Manual.

    Enter the username of the Windows Gateway machine.
    *Password This field is enabled when the Authentication = Manual.

    Enter the password of the Windows Gateway machine.
    *Credential List This field is enabled when the Authentication = Credential List

    Select the desired preconfigured credential list from the available options.
    Certificate Configuration
    Client Authentication Certificate Upload the client authentication certificate that is used to authenticate with the Windows Gateway endpoint.

    Click Upload to select the certificate. Only .p12 or .pfx certificates are allowed.

    You will be prompted to Enter Password for the certificate in the Authentication Details popup.

    Note: (Optional) Click Remove Certificates to change the uploaded certificate. This option is displayed above the Save Configuration button only after the certificate is uploaded.
    *: Mandatory fields
  3. Click Update and Validate.
    A connection Succeded message is displayed if the Windows Gateway is found to be up and running. Then Continue button is enabled.
    AppViewX validates both the network connection to the Windows Gateway service and the provided credentials.
    • Success: If both checks pass, a confirmation message appears, the status changes to Valid, and Continue is enabled.
    • Connectivity Failure: If the gateway is unreachable, an error message indicates that the service cannot be reached and credential validation could not run.
    • Credential Failure: If the gateway is reachable but the credentials fail, an error message displays the specific authentication failure (such as an incorrect username or password).
  4. Click Continue.
    The Validate Environment screen is displayed.

Validate Environment

The migration utility performs an extensive pre-requisite validation. This step ensures the following:

(A) Active Directory / MSCA Side

The system verifies that the user running the utility has the required permissions to:

  • Fetch Active Directory details (name or IP address)
  • Confirm that the logged-in user has Enterprise Admin privileges and Domain Admin privileges
  • Validate connectivity from the Windows Gateway to Active Directory over ports 88 and 389
Note: If you selected Standard PKI Migration, the wizard bypasses the following Active Directory administrative permission checks:
  • Verify membership in Domain Admins security group for domain-level management operations.
  • Verify membership in Enterprise Admins security group for forest-level Certificate Authority operations.

(B) AppViewX PKI Side

The system verifies that the migration utility has:

  • Permission to create new templates
  • Permission to read and validate CA configurations

If any required permission is missing, the system blocks the migration and displays clear, actionable error messages indicating the missing permission and the steps to resolve it (e.g., updating AD group membership or assigning roles in AppViewX).

The system allows migration to proceed only after successful validation.

The following validation checks are displayed in the UI with status either as Granted or Failed.

Environment validation

  • Retrieve domain name, domain controller, and network details from Active Directory
  • Verify network connectivity to domain controller on port 88 (Kerberos) and port 389 (LDAP)
  • Verify membership in Domain Admins security group for domain-level management operations
  • Verify membership in Enterprise Admins security group for forest-level Certificate Authority operations

AppViewX Validation

  • Create, modify, and manage Certificate Authorities in PKI-as-a-Service
  • Download AppViewX Enrollment Server
  • Create and manage service accounts for automation and integration
  • Create and manage PKI certificate templates for automated enrolment
  • Configure LDAP and Active Directory authentication settings
  • Configure and manage Windows Auto-Enrollment Protocol agent settings
  • View and access cloud connector configurations (only for SaaS – Cloud Connector)

Steps:

After all the validation checks are successfully completed, click Continue.
The Map Auto-enrollment CA page is displayed.

Map Auto-enrollment CAs

In this section, users can
  • Choose the Migration Strategy
  • Perform the CA Selection
  • Map and Migrate CAs

Migration Strategy

The user must select one of the two available migration strategies to proceed; the system allows only one selection at a time and blocks further steps until a strategy is chosen. The migration strategy cannot be changed until migration is completed.
  • Option 1 - Migrate Root CA to AppViewX - Full CA hierarchy migration. The selected Root CA and the subordinate CA are recreated in the AppViewX PKI.
    1. Recreates the Root CA in AppViewX PKI.
    2. Migrates all Subordinate CAs together.
    3. Selectively migrates Subordinate CAs; the system does not migrate unselected CAs.
  • Option 2 - Keep Root CA in ADCS and Migrate Subordinate CAs - Migrate only selected Subordinate CAs.
    1. Root CA remains in Microsoft.
    2. Migrates all selected Subordinate CAs together.
    3. AppViewX PKI acts as the Issuing CA only.

Steps:

Select Migrate Root CA to AppViewX or Keep Root CA as Microsoft.

CA Selection

This process allows selections of CAs for migration, it includes:
  • CA Discovery
    • Automatically initiates CA discovery after selecting a migration strategy.
    • Discovers all Root CAs in the current AD domain and forest.
    • Discovers all Subordinate CAs under each Root CA.

Steps:

  1. If you selected Migrate Root CA to AppViewX in the CA Selection screen, then select the appropriate Root CA and Subordinate CAs.
    OR

    If you selected Migrate Root CA to AppViewX in the CA Selection screen, then select the Subordinate CAs.

  2. Click Continue.
    The Map and Migrate page is displayed.

Map and Migrate

This step is used to map Microsoft CAs to the AppViewX PKI CA that will issue certificates. On the mapping screen, each ADCS CA (Root or Subordinate) is displayed as a source CA. Against each source CA, a dropdown is presented containing:
  • Existing AppViewX PKI CAs of the appropriate type (Root or Subordinate), or
  • An option to Create New PKI CA if no suitable CA exists.

Selecting Create New PKI CA redirects the user to the Create AppViewX PKI CA page and, once completed, returns the user to the mapping flow with the newly created CA available for selection.

For existing ADCS Root and Sub CAs, only AppViewX PKI Root CAs and AppViewX PKI Subordinate CAs are shown respectively. When migrating Root and Subordinate CAs together the hierarchical awareness is maintained on the UI—Once Root CA is mapped, existing Sub CAs under that AppViewX Root are shown preferentially. Subordinate CA mapping respects the selected Root CA hierarchy.

Steps:

  1. Select the appropriate AppViewX PKI Root CA and Subordinate CA from the dropdown on the right side of the page for the corresponding Microsoft CAs on the left.
  2. (Optional) If there are no AppViewX PKI CAs displayed in the dropdown, then click Create New PKI CAand add the CA details.
    Note: After creating the CA, go back to the Map & Migrate page and click the ‘Refresh’ icon next to the dropdown field to display the newly created CA in it.
  3. Click Continue.
    The Review Template page is displayed.

Review Templates

After mapping the Certificate Authorities, AppViewX initiates template discovery in Active Directory. The discovery process retrieves only the certificate templates that are actively associated with and published to the selected Microsoft CA. Templates published in Active Directory that are not associated with the selected CA are excluded from the list.
Table 2. Review Templates
Field Description
Name The Microsoft template name prefixed with AVX_PKI.
OID The Object Identifier assigned to the template in Active Directory.
Validity Period The certificate validity duration configured on the template.
Renewal Period The certificate renewal window configured on the template.
Key Length The key length and cryptographic algorithm supported by the certificate template.
EKU The Extended Key Usage extension identifiers and purposes.
Tip:
  • Search: Enter a template name in the Search by template name box to filter the table in real time.
  • Pagination: The table displays up to 25 records per page.
  • Persistent selection: Template selections persist across pagination and search filters.
Note: Templates configured for auto-enrollment are highlighted with a badge for easy identification.

To review and select templates:

  1. In the Review Templates table, find the templates you want to migrate:
    • To filter the list, enter the template name in the Search by template name box.
    • To browse more templates, use the pagination controls.
  2. Select the checkbox next to each template you want to migrate. You can select one or more templates across multiple pages.
  3. (Optional) To create a duplicate copy of a discovered template within Active Directory before migration, select Copy Template.
    Important: You can copy only templates that are actively associated with the selected CA.
  4. Click Continue.
    The Configure Template page is displayed.

Configure Templates

After the templates are selected, in the next stage a new certificate group must be created for the selected template. Corresponding equivalent AppViewX PKI certificate templates are then created for the selected AD templates. During creation, each AppViewX template is temporarily mapped to a default issuer CA to ensure complete configuration. The issuer is mapped based on the template permissions in AD.
Note: CA templates are not created by default. To create one, go to PKI > Templates > Create Template.

After selecting templates, configure equivalent AppViewX PKI templates and map them to their corresponding certificate groups and issuers. The created equivalent templates retain all source Active Directory configuration context for downstream auto-enrollment workflows.

The following table describes the fields and controls on the template mapping page:

Column / Element Description
MS Template The source Microsoft Active Directory Certificate Services (ADCS) template name.
AppViewX Template The generated AppViewX equivalent template name, suffixed with the migration name.
Issuer Name The Certificate Authority (CA) issuer mapped to the template.
Certificate Group The certificate group assigned to the template.
Search Enter a template name or attribute to dynamically filter the table.
Pagination Displays up to 25 records per page. Use the pagination controls at the bottom of the table to browse multiple pages.
  1. On the Map AD published templates with AVX templates page, select Create Certificate Group.
  2. In the Create Certificate Group dialog box, enter the group name and select Save.
  3. Select Create All Equivalents.
    The table displays the generated templates with their default mappings.
  4. Locate and review the generated templates:
    • Search: In the Search box, enter a template name or attribute to filter the list.
    • Pagination: If the migration contains more than 25 templates, use the pagination controls at the bottom of the table to navigate between pages.
  5. Optional: To modify an individual template:
    1. In the Action column, select the Edit icon next to the template.
    2. In the Modify Template pane, update the Certificate Group, Issuer Name, or AppViewX Template name.
    3. Select Save Changes.
  6. Optional: To update multiple templates simultaneously (bulk edit):
    1. Select the check boxes next to the target templates across any page.
    2. Select Bulk Edit.
    3. In the Bulk Edit pane, select the new Issuer Name from the drop-down list.
    4. Select Apply.
  7. Optional: To remove an equivalent template:
    1. In the Action column, select the Delete icon next to the template.
    2. In the confirmation dialog box, select Confirm.
    Note: Deleting an equivalent template removes it permanently from the current migration mapping. Deleted templates cannot be recreated or re-mapped within the same migration journey; you must initiate a new migration to include them again
  8. Select Continue to proceed to the WAEP configuration step.
    Important: Template configuration changes are saved only after you select Continue. If you leave the page before continuing, your changes are lost.

Configure WAEP

After creating and mapping equivalent certificate templates in AppViewX PKI, the system guides the user to configure and activate WAEP to enable endpoint communication for certificate auto-enrollment. The user defines an Agent Settings Name and selects a datacenter, upon which LDAP details are auto-populated. The user then provides service account credentials and performs a Test Connection to validate connectivity and configuration before proceeding.
  1. In the Configure WAEP screen, enter the details as follows:
    Fields Description
    Endpoint Details
    *Name The name field is read only and auto-populated by default with the Migration name set in the Download Windows Gateway stage.
    *IP/FQDN The dropdown list field contains a list of FQDN's from the stored data. Users can choose from the available values. The hostname format is <tenant>-aep.<domainname>.

    For Onprem the list is populated with the On-Prem node details. Select any one of the values.

    For SaaS the list is populated with the hostname of the Cloud Connector and AEP Gateway details.
    • Using On-premises CC
      • Without load balancer:It is the hostname of the cloud connector where the auto-enrollment gateway is running.
      • With load balancer: Manually enter the hostname of the cloud connector.
    • Using Direct Gateway: In the SaaS setup, to use the direct AEP gateway without installing the cloud connector, the FQDN/IP address will be the tenant URL with "-aep" before the domain name.
    *Port The port number is auto-populated based on the selected IP/FQDN value.
    If the IP/FQDN value is entered manually, then enter the appropriate port number.
    • HTTPS URL (always)
      • Onprem - 31443
      • SAAS - 30020
    *Datacenter Select the data center. The value is auto-populated based on the cloud connector.
    Global Catalog Configuration
    *LDAP URL List of LDAP/LDAPS configurations fetched from Platform.
    Configure LDAP Page A link below the LDAP URL field that redirects to Platform page to add the LDAP/LDAPS configurations.

    Refer to the section Configuring LDAP for WAEP for more details.
    Sync Fetches latest LDAP configuration data from Platform.
    *LDAP Base DN This field is displayed after selecting value in the LDAP URL field.

    If AD sync is enabled, the LDAP base DN is auto-populated based on the IP address of the global catalog server selected from the LDAP URL dropdown list.
    *: Mandatory fields
  2. Click Create WAEP agent.
    The new WEAP agent setting will be configured in the Auto-Enrollment: Windows AEP page (Go to Menu > CLM > Administration > Auto Enrollment > WAEP).

    The Setup Enrollment Server screen is displayed.

Setup Enrollment Server

After successful WAEP configuration and validation, the system progresses to the Enrollment Server setup stage.

Page 1: WAEP Details and Package Download
  • System Actions:
    • Displays the generated WAEP URL.
    • Provides option to download the AppViewX Enrollment Server package (with embedded WAEP URL).
  • During Download:
    • Creates a backend service account for installation and ongoing communication.
  • Post Download:
    • Displays setup instructions including:
      • Hostname, port, and agent details
      • Service account Client ID and Secret (to be added in the configuration file)
      • Once downloaded, refer Installing AppViewX Enrollment Server and perform the listed steps.
    • Prompts the user to start the service after completing setup.
Page 2: Installation and Configuration Confirmation
  • User Action:
    • Provides confirmation to execute a system-initiated configuration script
    • Follow the steps mentioned in Configuring Permissions for AppViewX to provide permissions for the auto enrolment server.
  • System Actions (Script Execution):
    • Registers CA as an Enrollment Service in Active Directory
    • Adds selected certificate templates to the CA
    • Publishes Root and Intermediate certificates as trusted certificates in the domain
  • Completion
    • System triggers script execution remotely on the target host
    • Validates each step for successful completion
    • On success, allows the user to proceed to the next validation stage

Steps:

  1. In the Setup Enrollment Server page, the first stage ——Download & prepare, the WAEP URL field is displayed and is read-only. Copy and save and URL for future reference.
  2. Click Download & prepare button.
    The AppViewX enrolment server zip file is downloaded successfully.
  3. Follow the installation instruction specified on the screen. Use the AppViewX enrolment server, client details and secret to complete the installation and start the service.
    Note:
    • The AppViewX enrolment server must be installed in the same machine where the Windows gateway was installed at the start of the migration journey.
    • After the dwnload is complete, refer to the section Installing AppView Enrollment Server to perform the installation.
  4. Click Continue.
    The Setup Enrollment Server page, second stage ——Install and run page is displayed with the set of instructions.
  5. Follow the steps mentioned in the Instructions to provide permissions for the Auto enrolment server. Additionally, refer to the section Configuring Permissions for AppViewX.
  6. Click the I approve AppViewX to install on the machine checkbox.
    The Run setup button is enabled.
  7. Click Run setup.
    The following script executions are performed at the backend:
    • Registering CA as an Enrollment Service in Active Directory
    • Adding selected certificate templates to the CA
    • Publishing Root and Intermediate certificates as trusted certificates in the domain
  8. Click Finish.
Post-Migration
  1. How to verify migrated templates in Menu > PKI > Certificate Templates.
  2. How to manually initiate certificate enrollment from the AppViewX GUI when WAEP is deferred.