I may be going about this in the hardest way possible, so let me stop and roll everything back to my root need:

I have two IPA servers which manage our infrastructure. We used to have three, but a catastrophic failure on one led to its total loss. And it was our CA.

So now we have no CA -- is there a way to promote an existing system to take over? I realize it may well mean distributing a new root CA cert to everyone, but that seems less painful now than trying to set up a brand new cluster of servers and try to port our data over to them...

--
photo
Bret Wortman
President, Damascus Products LLC
855-644-2783 | 303-523-8037 | bret@damascusproducts.com | http://damascusproducts.com/ | 10332 Main St Suite 319 Fairfax, VA 22030