On Wed, Jun 3, 2020 at 3:27 PM Simo Sorce <simo(a)redhat.com> wrote:
> Abusing this thread, is it possible to re-key the root CA with a with a
> longer key length while keeping the sub CAs and rest of signed
certificates
> or do we need to reissue all certificates for everything?
In principle you can always create a new CA and then sign any other CA
including the original CA with its keys. I do not know if we make this
easy in FreeIPA though.
Do I need to open a case with Red Hat support for this? It would be
valuable for the community as well.
--
regards,
natxo