When I first set up this Win2K3 domain, I installed a root CA and a subordinate CA. We started to have problems with the certificate exchange within the domain, so I looked up the problem here and ran the certutil function, which cleaned it all up. the result is that all 3 DCs (including what was the root CA) now get their certificates from the subordinate CA. We have users that get certificates forwireless authentication, all of them already come from the subordinate CA.
That was OK, but now that we are expanding our use of CA services, we have a need for an authoritative root certificate. So, I see 3 options:
1. rebuild the whole CA system and issue all new certificates (not my preference).
2. Build a new root CA and somehow point the subordinate to the new root.
3. Promote the subordinate to root, and build a new subordinate.
I don’t know the answer, that’s why I’m here. Maybe there is another option? Can someone tell me how to fix this please?
thanks!