Renewing a CA cert

Quick queston. If you renew the CA certificate you can choose to keep the same key pair or generate new keys. Generating new keys is obviously more secure, but is this then going to expire all of the certs that were created with the old pair? I can't find a definitive answer, but it seems logicial.
Thanks
Thanks
Decide what to be and go be it.
Comments
Generally speaking, for x509 cert implementations, you can renew your CA cert off the same key pair. The only thing that expires is the public certificate, not the private keys. You'll need to distribute and install the new public CA cert through whatever means you initially distributed it. The same thing goes for client certs as well. There's no need to generate a new keypair, you just generate a new CSR off your exisiting key pair, send the CSR in for the CA to sign, and install the new cert that you get back.