Remotely sign the IDM CA after implementation

I've had an operational IDM implementation for almost 2 years. The CA option is implemented. I need to sign the CA with an external organizational certificate, thus relegating the IDM ROOT CA to intermediate CA status.