Our Root and Issuing CA were set to expire next month, so this past week we renewed both certs with the same key pair. That went smooth, and new requests are using the new certs as expected.
Our domain controllers have not yet to automatically renew their certs with the updated certs yet. I know this happens automatically at I think 75% of the lifetime of the cert, but with the CA server having new certs, I am wondering if they will automatically renew correctly, or do I need to do something in order for them to renew with the new certs.
Should I just wait longer, or is there a way for me to force the DCs to update their certs more quickly?