I have an offline root and am trying to constrain it using the EKUs so it doesn't have all application policies.
Most of this is trial and error and I"d like to make this more efficient rather than uninstalling reinstalling the subCA just to get a new certificate to get signed by the root.
How can I (using the commandline) reinstall the CA so that it will properly generate a new request file (to be processed by the root ca) and read the CaPolicy.inf
and Policy.inf
appropriately?