I'm starting to look more thoroughly into CA and something I'm not sure
is possible, and hoping you could shed more light onto, is - having IPA
deployed with own CA is it possible to then, at a later point,
move/migrate/change IPA to subordinate type of CA with AD's CA as root?
Is such a change a SOP or rather something undocumented-unsupported but
possible & risky?
many thanks, L.