> Abusing this thread, is it possible to re-key the root CA with a with a
> longer key length while keeping the sub CAs and rest of signed certificates
> or do we need to reissue all certificates for everything?
In principle you can always create a new CA and then sign any other CA
including the original CA with its keys. I do not know if we make this
easy in FreeIPA though.