We have generated an internal root Certificate Authority for our organization and added X509v3 Name Constraints for our domain (example.com)

We issued a number of certificates for servers under that domain.

Now, we have a second domain (example.net) and want to issue internal certificates for hosts under that name.

Can I adjust the X509v3 Name Constraints on a CA without invalidating all the certificates that CA has issued, or do I need to create a new CA?

marked as duplicate by Josh, schroeder Jan 23 at 8:39

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


A certificate can not be modified and this includes a CA certificate. But you can issue a new CA certificate with the same subject (and subject key identifier) and the same public key but with different name constraints. Since subject and public key are the same this CA can then be used in place of the previous CA to verify previously issued certificates.

Not the answer you're looking for? Browse other questions tagged or ask your own question.