Change the signing algorithm of a certification authority hierarchy without issuing new certification authority certificates
Sometimes it may be necessary to subsequently change the signature algorithm of an already installed certification authority hierarchy.
This is often the case because one has installed them with PKCS#1 version 2.1 and unfortunately finds out afterwards that not all applications are compatible with the resulting certificates, and thus cannot use the hierarchy.
While it is relatively easy to change the signature algorithm for certificates issued by a certification authority, it is more difficult to do so for certification authority certificates.