<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 10/2/2016 1:04 πμ, Ryan Sleevi
wrote:<br>
</div>
<blockquote
cite="mid:CACvaWvYxop+M0U0jHDRxrv1K6DTH4R6pAG2X8i3A5GTB0s-9qA@mail.gmail.com"
type="cite">
<div dir="ltr">[...]
<div><br>
</div>
<div>Even if a Root Certificate was generated before 20 bits of
entropy became a requirement, the CA could certainly bring
that key out of offline storage and re-generate it. They have
to have the key still (so they can revoke the intermediates or
generate the short-lived responder certificates), and while it
means the certificate generation ceremony must be followed, it
does not strictly seem like an unreasonable requirement to
conduct during the next audit, where your auditors are already
on site.</div>
<div>
<div class="gmail_extra"><br>
</div>
</div>
</div>
</blockquote>
<br>
The current <a
href="http://social.technet.microsoft.com/wiki/contents/articles/31633.microsoft-trusted-root-program-requirements.aspx">Microsoft
Root Program</a> technical requirements in Section 4A.6 states
that:<br>
<br>
"Private Keys and subject names must be unique per root certificate;
reuse of private keys or subject names in subsequent root
certificates by the same CA may result in random certificate
chaining issues. CAs must generate a new key and apply a new subject
name when generating a new root certificate prior to distribution by
Microsoft".<br>
<br>
I believe that regenerating the RootCA with the same key is not
compatible with this requirement but I might be wrong here.<br>
<br>
<br>
Best regards,<br>
Dimitris.<br>
</body>
</html>