I'm about to regenerate a certificate of my CA (maintained by OpenSSL) used mostly to provide OpenVPN access to the intranet for my clients.
My question is related to this one — "Certification authority root certificate expiry and renewal". An excellent reply to it provided by Shane Madden explains that the trust to certificates signed by a particular CA actually rests in the signature of the CA's private key, and so that if the CA's own certificate is replaced, the chain of trust is not broken provided that new certificate has been signed by the same private key.
The problem is that I'm mostly using my CA to generate certificates for OpenVPN clients; each client receives a PKCS#12 file which bundles the client's certificate and the key, and the CA certificate so that the client is able to trust the certificate of the OpenVPN server. The server, in turn, is told to read the same CA certificate which gets bundled for the clients.
So my question is: if I replace the CA certificate so that the OpenVPN server will see it immediately while the clients will have the old CA certificate in their PKCS#12 bundles, will the clients still trust the server's certificate?
Or should I take another route and go like this?
- Regenerate the CA certificate but defer its deployment.
- Regenerate and redeploy PKCS#12 bundle for each of my clients including both the active CA certificate and the new one.
- Finally deploy the new CA certificate on the server.
Presumably, this will make the clients pick whatever CA certificate they see fit, though I'm not sure.
I would appreciate any advice on the strategy I should employ to deal with my situation.