Self Hosted Root CA 10 year expiry renewal.

[ken-master]

Setup: Self-hosted

So Root CA expiration has a 10years validity. we want to rotate or renew the root ca at 1 year before it expires. What I was testing is to create a new Root CA with different port. i.e

old: ca-root-url.com
new: ca-root-url.com:9000

• bootstrap to the new ca url
• re-create the crt/key from the new ca url
• decommission the old ca- url

this seems tedious to implement. is there a straightforward implementation for this?

[tashian]

It can be a complex process to rotate roots.

The general steps are:

1. Stand up a second CA and new root
2. Add the new root to all clients as trusted
3. Migrate all certificate issuance over to the new CA
4. Remove old root as trusted (optional)
5. Turn off the old CA

One thing we've added to simplify things a little, in the step client, is the contexts feature.
It lets you easily manage multiple CA connections.