On to, 20 kesä 2019, lejeczek via FreeIPA-users wrote:
I'm starting to look more thoroughly into CA and something I'm not sure
is possible, and hoping you could shed more light onto, is - having IPA
deployed with own CA is it possible to then, at a later point,
move/migrate/change IPA to subordinate type of CA with AD's CA as root?
Is such a change a SOP or rather something undocumented-unsupported but
possible & risky?
It is possible and is a routine action.
-- these are our tests of this feature which run for every pull request.
Look at TestSelfExternalSelf suite, it should be more or less
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland