This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(3.2, 64%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EK%3C/text%3E%3C/svg%3E)
Hi,
Can an existing Enterprise Subordinate CA be signed by a new Root CA? This SubCA will be revoked by the original Root, as it will no longer be part of the current hierarchy. Our client may want to have the SubCA continue running without having to build an entirely new hierarchy and issue all certificates again.
Yes, just renew your SubCA with new key pair and sign request by another Root CA. It is supported.
Hi, thanks for the reply!
Are there things our client need to consider for the existing issued certificates to continue working? I mean these will chain back to the original root CA CRL, so they would be invalid if we are to revoke the subca? Only new issued certificates after the SubCA has been signed by the new root will work then, so they will still have to reissue the certificate that are in use today? Or?
Thanks!
Previously issued certificates will chain to old root. If you revoke sub CA certificate that is signed by old root, only previously issued certificates will become invalid. Newly issued certificates (after sub CA renewal) will chain to new root and won't be affected by previous sub CA certificate revocation. The only important thing is that sub CA must be renewed with NEW KEY PAIR. You will be prompted during renewal whether to generate new key. Say YES to it. No exceptions.