Hi all,
due to extended cooperation with other companies we now have to set up a
shared PKI with our business partners.
Currently, we have got a single enterprise root CA for our Active Directory
(single domain) in place. It has been running for about two years now and
there is quite a number of certificates issued (>1000). The challenge we are
facing now is migrating from our local root CA to the shared public root CA
without the current certificates becoming invalid.
Public root CA (offline) is already in place. The responsible administration
team will provide an intermediate CA for our company, and we would like to
keep that one offline, too, and set up an issuing enterprise CA for our AD.
I thougt about that some time and determined that there is no need to keep
the current enterprise root CA running once all certificates have been
replaced by new ones. Because of that I would like to avoid
cross-certification and migrate in the following way:
- Publish new public root CA and intermediate CA to AD
- Set up issuing CA as enterprise subordinate
- re-issue certificates when suitable
I have now encountered some points which are not clear to me:
- Is this a valid migration path from a technical perspective?
- Is it possible to publish multiple root CAs to AD?
- Will the issued certificates stay valid with the new PKI in place until
they are replaced?
- How can I achieve that new certificates from our customized V2 templates
are issued by the new issuing CA instead of our old enterprise root CA?
Thanks in advance for your help!