I am trying to move an existing Win 2003 sub CA (of an Enterprise CA) onto a new server. The root CA will stay but I'd like to get rid of two sub CAs and replace them with member servers on new hardware with new names. The two existing sub CAs are 2003 DCs that need to be demoted and removed from the network. There are already several hundred certs that have been issued by these sub CAs. How can I move them to one of the new servers (or do Ihave to)? Can I just demote them, turn of CA services and let clients request new certs from the new servers when their current ones expire?