Guidance on Transitioning to an External Root CA While Keeping Existing Root CA Valid

[nelsonduvall]

Hello Dogtag Users,

My team and I are planning to migrate our existing internal Dogtag Root CA to an external CA, but we need to maintain our current Root CA’s validity for a certain transition period to ensure uninterrupted services. We are seeking advice and best practices from those who have gone through a similar process or have expertise in this area.

Below is a summary of our situation and the key points we’re hoping to clarify:

Environment Details

• Dogtag version: 11.4
• Current setup: Single Root CA issuing certificates for internal services
• Plan: Introduce a new external Root CA and phase out the existing internal Root CA

Transition Strategy

• We want to keep the internal Root CA active and valid for a certain period during the transition.
• Advice on how to manage certificates already issued by the current CA, especially regarding revocation and renewal.

Additional Questions

• Is a cross-certification or a sub-CA arrangement typically used when moving from an internal Dogtag CA to an external CA? Are there any known pitfalls?
• How do we manage the overlap between two valid root CAs to avoid client-side trust issues?
• What is the best practice for handling CRLs or OCSP responses during the transition? How do we ensure that the old CA remains trusted until all certificates are reissued or expire?
• Are there Dogtag-specific tools or commands that simplify this migration process (e.g., generating a new CA profile or chaining certificates correctly)?

We greatly appreciate any insights, documentation pointers, or step-by-step guidance you can provide.