New PKI 2-Tier Setup on existing domain with old PKI

[techie923]

Hello all,

so I want to add a 'new' PKI 2-tier infrastructure to our domain. There is already an older 2-tier(Root and IssuingCA) in place but it seems like all the certs have either expired or have been revoked. My plan is to build a new Root and a new Issuing, transfer all existing server certs to the new RootCA and decommission the old setup once I know the clients are receiving the new certs from the new Root/IssuingCA. Has anyone been in this situation before? What steps were done to complete this setup? Any help on this is appreciated. 

 

-techie