So just to finalize this (feel free to rebut Steve)...
When faced with CA expiration, you have two choices. You can either;
- Rollover the key (same name, new key), or;
- Rollover the CA (new name, new key).
the second case is not "rollover" because the CA name changed and,
according to X.509 and PKIX, the new name represents a new CA. the
term "key rollover" is used to refer to a key change where the name
of the subject stays constant, whether the context is an EE or a CA.