Ssl certificates disappear IIS

if I run SSLDiag on the new server, I get the error "#WARNING: You DON'T have a private key that corresponds to this certificate". [...] I can't find any way to import the key along with the certificate.

I do not know the specifics of IIS, but yes, you positively need both the (public) TSL (SSL) certificate and the (private) key. If the server does not have the private key, it cannot use the corresponding certificate; that's just how TLS works. There has to be a way to export both, you'll have to dig in the manuals :-).

Do I need to renew each certificate, and if so, is this something that would cost money?

No, certificate renewal has nothing to do with moving servers. You can just copy the pulic and private certs/keys. Of course, the TSL certificate is tied to a specific domain name, so if the domain name changes, you need a new cert (not just a renewal).

By renewing the cert, does it invalidate the one on the old server?

What do you mean by "invalidate"? A TLS certificate cannot be invalidated; it can only be revoked by the issuing authority. That is something they could do if you renew, but I've never heard of any issuer that actually does this. So you can continue using the old cert even after a renewal.

I believe you have a certificate of the wrong type the IIS certificate needs to authenticate the server to the client and therefore needs to have the key usage server authentication you indicate it has client authentication. Without more detail its hard to tell but thats what im reading from your text. IIS wont let you pick it as its not suitable is my suggestion.

Where other templates available from the CA, with Server Auth available?

What was the CA type?

Mark Sutton
http://www.blacktipconsulting.com