[Cfrg] How to issue CRLs after the private key of old root certificate has been destroyed?

[Wang Guilin <[e-mail]>]

Dear all, 

I am here to enquire one question about revoking PKI certificates. 

In practice, to guarantee high security, the validity (say 10 years) of a root certificate private key may be essentially shorter that the validity (say 30 years) of the corresponding public key. After the first 10 years, a new root certificate with a new key pair will be generated, and the old root private may be even destroyed. After that, however, how can we use the new root private key to issue CRLs to revoke certificates previously signed by the old root private key? 

At first, I thought this is the case of using indirect revocation mechanism discussed in RFC 5280, which may involve the link certificate NewWithOld, which is a certificate for the new root public key signed by the old  root private key. However, it seems that indirect revocation only works for different entities. Namely, by using indirect revocation, the certificates issued by A can be revoked by a different entity B. However, in the above case, the old and new root certificates are for the same entity (or owner). So, my real questions is: Can indirect revocation be used in such a scenario? If not, is there any good way to do this, especially if interoperability with TLS, SSL, IPSec etc is required? 

Thanks a lot in advance, 

Guilin