hi,

We have a new realm with rhel 7.8 and a default CA key of 2048 bits.

Recently a question arose to upgrade this to 4096 bits.

According to this blog post https://frasertweedale.github.io/blog-redhat/posts/2020-01-28-freeipa-override-ca-key-size.html ) this should already be possible for new deployments with RHEL 8.1 but is it possible to configure the root CA and eventually sub CAs to use the 4096 bits signing keys? In doing so, do we need to resign all certificates already in use?

Is it possible to do this in RHEL 7 or do we need to update the CA hosts to 8.1 to achieve it?

Thanks in advance for your answers.

--
Regards,
Natxo