We have deployed DirectAccess in our network for our Windows 7/10 clients which works great. The issue is, the DA server/client certificates are based on a internal PKI we are retiring; we have build another PKI (two-tier, offline rootca and subordinate ca) that we are migrating all our certificates to.
The issue I have is migrating our DA infrastructure over to the new PKI. I will need to issue a new computer certificate template to the client computers (along side the old computer certificate to keep their existing DA capabilities); then once all the clients have a computer certificate from the new PKI, I will update the certificate on the DA server.
The issue (or lack of knowledge) I am having is what happens then? Will clients be able to reconnect to the DA server using the new certificates issued by the new PKI?
Or will this break badly until they are on the network to get latest GPUPDATE.
Anyone go through something like this want to share their experience? What is my best course of action.