In our Windows Domain (2008R2 and 2012R2 Servers), we are running a Domain CA. The root certificate is a self-signed certificate.
We also have a x.509 certificate from our internet provider (mostly for our websites), signed by a trusted internet CA.
What i want to do is remove the self-signed root certificate from the Windows CA and replace it with the certificate from our provider.
Two questions: 1. is this even possible? Can i use a certificate from a trusted CA as root certificate for my own CA? 2. will this be possible without rebuiliding the whole domain? I think the domain controlers need the certificates for their LDAP communication, what will happen if i just switch the root certificate they used to create their own certificates?
Thanks for your help!