Can we add additional signing CA for Cisco IOS IPSEC VPN?

Hi,

let´s say you have a utm site which was deployed in 2007 and still uses the same signing ca created back there. If you want to use Cisco IPSEC with IOS that will probably not work - you have to create a new signing ca. On the other hand - all previously created VPN tunnels will probably not work after that. So the question would be - is it possible to create another fresh signing ca or is still only one signing ca possible per utm? what will happen if you create a new signing ca? will all previously created vpn tunnels go offline or will the utm somehow convert the old signing ca and will verify it nevertheless?

Best,

Joerg