I posted this question in the NW forum and they told me I should ask the
BM forum to be sure there are no special BM problems:

Our current root CA certificate runs on our oldest server (last NW6.0 in
our tree) which has to be deleted.
We have a worldwide NDS over a BorderManager-VPN. Is there anything
special I should take care about in this connection? Will all VPN
connections be dropped when I delete the old CA and create a new one?
How can I in this case re-create the certificates on all remote servers...?

Any advice/handbook is appriciated :-)
Thanks, Franz