Then far in the future, when your own Root CA expires, then there comes all the trouble to update all the services/devices to trust the new Root CA. This becom

Then far in the future, when your own Root CA expires, then there comes all the trouble to update all the services/devices to trust the new Root CA. This becomes a nightmare, when the original admin in the org is gone long times ago.