On Wed, Jun 3, 2020 at 3:27 PM Simo Sorce <simo@redhat.com> wrote:

> Abusing this thread, is it possible to re-key the root CA with a with a
> longer key length while keeping the sub CAs and rest of signed certificates
> or do we need to reissue all certificates for everything?

In principle you can always create a new CA and then sign any other CA
including the original CA with its keys. I do not know if we make this
easy in FreeIPA though.

Do I need to open a case with Red Hat support for this? It would be valuable for the community as well.

--
regards,
natxo