Documentation on rotating the root certificate

[srinisudharsan]

While it is not common, there is always the possibility that one would have to rotate the root CA. Could you add documentation on how to do it without downtime?

[braunsonm]

Also would like to know this. Is it possible since you'd need to trust the old and new at the same time?
We were actually looking to use an intermediate CA so would it be possible to trust the root, renew the intermediate, then change back to only trusting the intermediate?

[SpectralHiss]

Your trust store PEM could be two different roots at the same time, so even if there is no intermediate you can just append root1 and root2 in a transition phase, rotate all pods and then remove root1 from the trust store.