What is best practice in renewing certification authorities? I mean when should I renew certification authority?
For example, suppose I have the following setup: 1. Root CA with validity of 30 years 2. Sub CA with validity of 20 years issued by Root CA
When renewing certificate of Sub CA after 20 years, it can't have another 20 years because of Root CA certificate would expire before, so in that case new Sub CA would have validity of 10 years.
Or should I renew Root CA 10 years before expiring old certificate and start issuing certificates from this new Root CA?
Or another approach can be to issue new Sub CA 10 years before its expiration and start issuing end entity certificates from the new Sub CA after.
I would like to get a deeper insight into rules how are such situations managed in real life. What should I be looking for to manage certification authorities correctly and renew its certificate in time?
EDIT to have a better understanding:
How would you manage renewing of certification authority with validity of 5 years and issuing end entity certificates with validity 3 years?
What would you do and when in order to have a smooth process transparent to end users?