Hello @willfurnell
As far as i know, no, there is no way to merge the CAs, so yup you got to resign everything.
EDIT : you can halve the process if you export the CA you used on ones of the zone on your master, you’ll however need to resign everything manually for other zone.
Given your diagram, i would say that yes it will work, and it’s a pretty common icinga configuration (ref here )
I’d however advise you to cluster your master with an other instance to ensure resilience, for the database part its more or less critical, but depending how much you rely on it it can be required to cluster it as well.
Also, from experience i’d advise you to have at least one satellite or one master or one database from same cluster in different physical location of its twin to ensure resilience of icinga zones if you can afford it (let say for example to avoid loosing your monitoring if a room get out of network/energy )
If you are interested in getting the database resilient there is a well made tuto here, for others parts of your diagram, for now it’s common enought to rely safely on the official docs.