The server certs on the box that holds the CA are about to expire. Do I need to move the CA to a different server before renewing the server certs?