I have to replace a old root certificate with new root certificate, but before remove it, I have to sign the new one with the old one. The certificates has extension .pem. Which