ADCS-CSP to KSP-Problem with cert backup for migration

Subject: AD Certificate Authority Migration - CSP to KSP Issues

Hi,

We have a Windows Server 2019 (W2K19) running an Active Directory Certificate Authority (AD CA), which is still using the Cryptographic Service Provider (CSP). This is due to an OS upgrade from an older VM.

The root certificate has been renewed multiple times without renewing the key for years. Now, I need to migrate this CA to the Key Storage Provider (KSP) to issue a root certificate using SHA-256.

When following guides like this one, I encounter the following error while backing up the CA:
"Windows cannot backup one or more private keys because the CSP does not support key export."

I found a potential solution https://learn.microsoft.com/en-us/archive/msdn-technet-forums/453a2991-2b65-414b-b0f4-ec90f8204889 related to dashes in a registry key, but it did not work.

While I can back up the certificate, it does not show a key icon, which makes me hesitant to proceed with the migration.

I have a few questions:

1. Can I carry on with this error and successfully migrate the CA from CSP to KSP ?
2. Alternatively, can I issue a new root certificate with a new key?
3. If I issue a new key, will it invalidate the current key (which has been renewed for years)?
4. Can both certificates coexist at the same time?

Any guidance would be greatly appreciated.

Thanks,