This question already has an answer here:
We have generated an internal root Certificate Authority for our organization and added X509v3 Name Constraints for our domain (
We issued a number of certificates for servers under that domain.
Now, we have a second domain (
example.net) and want to issue internal certificates for hosts under that name.
Can I adjust the X509v3 Name Constraints on a CA without invalidating all the certificates that CA has issued, or do I need to create a new CA?