Prior to SP1 for Server 2003, you could install cert services on a 2003 machine in a 2000 AD and it worked fine for issuing verion 1 certs. Service Pack 1 included some security enhancements that broke this functionality, but you can still get it to work...