Consider a certificate used by a Certification Authority. This is currently hashed using SHA-1. I'd like to keep the same public/private key for this, but hash it using SHA-256. By hash it I mean hash the tbsCertificate section - as described in RFC5280 - using SHA-256, followed by signing the digest with the private key of the original CA that actually issued the certificate.
This comes in the context of this article, where it's stated that
If you want to convert a CA certificate on an ADCS version prior to Windows Server 2012, you must export the CA cert off of the CA, import onto ADCS 2012 or later using certutil.exe with the -KSP option, then export the newly signed certificate as a PFX file, and re-import on the original server.
Besides the typing error (there's no -KSP, only a -CSP switch).
However, if you use a different CA to sign a certificate this results in the use of a different private key, providing that the Authority Key Identifier stays the same, and the public key of the referenced CA won't verify this new signature. Does this generate a certificate that would fail validation?