I'm for the first time contemplating CA service from a public CA to
subordinate IPA to it - would it make sense with a *.sub.domain cert, if
such one cert one already has from that public CA, to still want to sub
(not a CA expert so go easy on me)
many thanks, L.