Currently, I have one online enterprise root-ca (and issuing certificates - default templates) that installed on DC (yes, yes I know - worst case scenario). I set another offline not joined to a domain server, 2 IIS servers under LB and 2 enterprise issuing servers and I need few answers before I proceed:
NOTE: The final goal is to REPLACE and not migrate current set/certificates.
1) The current CA common name (not server name) is example-root-ca can I give to the new offline server CA root same common name while installing the CA role? Will it affect somehow the current certificates? Should I use the new name and why?
2) Installing multiple subordinate issuing servers, again while you configure the CA role it asks for common name also - so 2 servers should use the same common name? or its fine they have different common names (or even as far as I remember it must be unique)? - In such case, I am thinking of how the client will get the certificate? some will get from server one and some from server 2? What will happen when they will try to renew?