We currently have Microsoft Enterprise Certificate Server installed on a domain member machine which issues 1 year certificates to users for authenticating to VPN.
We'd like to start issuing web server certificates from our CA to secure Dell Open Manage (a systems management application) and also Microsoft RDP. Because we have quite a few servers (100+) and I haven't found a way to automate certificate installation (note installation - not deployment - I know how to automatically deploy) we're considering issuing certificates for the lifetime of the server. Most of our servers are used for 10 years or less so we'd want 10-15 year certificates.
As I understand, CA's can't issue certificates longer than they themselves are valid. Thus if we wanted to issue 10 year SSL certificates our root CA certificate would need to be valid at least 11 years but practically probably 15-20 years.
Additionally I understand that the longer the duration of the certificate the more susceptible the private key is to compromise and thus the desire to use a longer key length for longer certificates.
I'm considering renewing the root certificate for a longer duration but I have the following questions:
1) Is generating a root certificate 15-20 years within best practices? Again I understand ideally we would issue certificates for a shorter duration - but the manual labor involved with installing said certificates each year isn't trivial thus the desire to use a longer length - so long as doing so is reasonably safe
2) Should we use 4096 key length for the root CA or can we use a shorter key? Some reading I've done suggests some network devices won't support certificates longer than 2048 bits.
3) When renewing the root certificate we have the option of reusing its existing key pair or generating a new key pair. I understand generating a new key pair is better from a security standpoint but do if we do that will our existing issued certificates continue to function without needing to make any changes?