we use win2003 domain. we have only one CA in the domain. So it is SPOF. Is it possible to redundant Certification Authority ?

Depending on what SPOF you want to get rid of, you can either cluster the CA or set up another enterprise CA and configure it to deliver the same service as the first one. Using clustering will cover most of the aspects of high-availability of a single CA including enrollment and revocation. Read more about clustering ADCS http://technet.microsoft.com/en-us/library/cc742517(v=ws.10).aspx Having multiple enterprise CAs will cover the enrollment requirements bu you still need to cover revocation handling. /Hasain

Thank you. Is it OK to have second Root Enterprise CA in the domain as backup ?

Having a second enterprise CA will cover the enrollment of new and expired certificates but you need to take care of the CRL and revocation information related to the first one /Hasain

Thank you. Is there easy way to make replica of existing CA ?

Hi, Regarding CA Redundancy, here are two threads for your reference: Redundancy With Certification Authority http://social.technet.microsoft.com/Forums/en-US/winserversecurity/thread/4aa1a95a-cfc6-42a6-98b0-0aab5b2f8634 subordinate redundancy http://social.technet.microsoft.com/forums/en-us/winserversecurity/thread/9AD64EDD-61DA-4552-B30D-22418E1C8EF0 Regards Kevin

Hi, Regarding CA Redundancy, here are two threads for your reference: Redundancy With Certification Authority http://social.technet.microsoft.com/Forums/en-US/winserversecurity/thread/4aa1a95a-cfc6-42a6-98b0-0aab5b2f8634 subordinate redundancy http://social.technet.microsoft.com/forums/en-us/winserversecurity/thread/9AD64EDD-61DA-4552-B30D-22418E1C8EF0 Regards Kevin

Having a proper backup of the CA keys and certificates, CA database and the CA setting will give you such possibility but it is strongly not recommended to have the same CA in more than one instance at the same time. /Hasain

Having a proper backup of the CA keys and certificates, CA database and the CA setting will give you such possibility but it is strongly not recommended to have the same CA in more than one instance at the same time. /Hasain

Is it possible to make new Root CA and replicate original CA to new CA like Domain Controller ?

No, this is not supported! You can not "replicate" a CA the way you describing it and your closest option is clustering! /Hasain

No, this is not supported! You can not "replicate" a CA the way you describing it and your closest option is clustering! /Hasain