[aidenn0]

For client-side it does require a new CA, but for server side it does not (since you have access to all of the private keys in use). Given that banks are pushing for this standard, that would make a lot of sense.