Hi, you can find a draft of the design document for this feature at <http://www.freeipa.org/page/V3/CA_certificate_renewal>. Comments are welcome. Honza -- Jan Cholasta