Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a personal certificate which is signed by a certificate authority. This certificate is unrestricted with respect to its allowed purposes. Is it possible to create a SSL server certificate on my own and sign it with my personal certificate?

Supose the root certificate authority belongs to the trusted ones of those installed in a web browser. Suppose further that there are no other warnings e.g. timestamp warnings. Will the browser show the "green bulp" even when the "chain of trust" has four or more instances?

Which tools would be appropriated to create such a certificate?

There is another question What kind of certificate do i need to be able to sign my own subdomain certificate. This question has its primary focus on wildcard certificates and on how to uniquely identify multiple sub domains within the same domain. In contrast I ask for the prerequisite which a personal certificate must have and a tool to create a SSL server certificate signed by this personal certificate. The question about subdomain certificates has no answers refering to these aspects to date.

Thank you

share|improve this question

marked as duplicate by Terry Chia, Thomas Pornin, AJ Henderson, this.josh, Scott Pack Mar 15 '13 at 17:16

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

2 Answers 2

up vote 7 down vote accepted

Depends on the value of the Certificate Basic Constraints field of your certificate. Most probably it will be Is not a Certification Authority. However, you can get a CA type certificate which is allowed to issue more certificates. The main CAs (top level) have certificates with the value of Certificate Basic Constraints of the form

Is a Certification Authority
Maximum number of intermediate CAs: unlimited

Sometimes, you see certificates of the form

Is a Certification Authority
Maximum number of intermediate CAs: 0

which means that they can issue certificates, but they can't issue certificates which can issue certificates. In other words, they can only issue certificates of the Is not a Certification Authority type. For example, Google signs each of its subdomains separately using such a certificate.

You can also find

Is a Certification Authority
Maximum number of intermediate CAs: 1

which means that they can issue certificates of the Is not a Certification Authority and certificates of the Maximum number of intermediate CAs: 0 type.

Check with your CA to see if you can get an Is a Certification Authority certificate.

share|improve this answer
1  
This is correct, and often times the intermediate CA count is called path. –  makerofthings7 Mar 14 '13 at 15:09

Yes, the number of "hops" in the chain of trust is not relevant, but the tag on the certificate indicating that this certificate is allowed to sign other certificates is important.

For setting this up, I would recommend OpenSSL. See Creating an SSL Certificate of Authority for an example on how to do it.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.