Create a SSL certificate and sign it with a personal certificate which in turn is signed by a certificate authority [duplicate]

Question

This question already has an answer here:

• What kind of certificate do I need to be able to sign my own subdomain certificates? 2 answers

I have a personal certificate which is signed by a certificate authority. This certificate is unrestricted with respect to its allowed purposes. Is it possible to create a SSL server certificate on my own and sign it with my personal certificate?

Supose the root certificate authority belongs to the trusted ones of those installed in a web browser. Suppose further that there are no other warnings e.g. timestamp warnings. Will the browser show the "green bulp" even when the "chain of trust" has four or more instances?

Which tools would be appropriated to create such a certificate?

Thank you

Answer 1

Depends on the value of the Certificate Basic Constraints field of your certificate. Most probably it will be Is not a Certification Authority. However, you can get a CA type certificate which is allowed to issue more certificates. The main CAs (top level) have certificates with the value of Certificate Basic Constraints of the form

Is a Certification Authority
Maximum number of intermediate CAs: unlimited

Sometimes, you see certificates of the form

Is a Certification Authority
Maximum number of intermediate CAs: 0

which means that they can issue certificates, but they can't issue certificates which can issue certificates. In other words, they can only issue certificates of the Is not a Certification Authority type. For example, Google signs each of its subdomains separately using such a certificate.

You can also find

Is a Certification Authority
Maximum number of intermediate CAs: 1

which means that they can issue certificates of the Is not a Certification Authority and certificates of the Maximum number of intermediate CAs: 0 type.

Check with your CA to see if you can get an Is a Certification Authority certificate.

Answer 2

Yes, the number of "hops" in the chain of trust is not relevant, but the tag on the certificate indicating that this certificate is allowed to sign other certificates is important.

For setting this up, I would recommend OpenSSL. See Creating an SSL Certificate of Authority for an example on how to do it.