Disclaimer: I have low knowledge of X.509 and PKI, so I would appreciate an answer that is not entirely technical, i.e. by using real-life example scenarios.)
I was searching for information about 4096-bit TLS certificates, found an article talking about it and how you could generate a self-signed certificate.
Signing your own key.
openssl x509 -req -days 730 -in my.csr -signkey my.key -out my.crt
Signing your key will save you the few bucks a year a CA will charge you, but it will not be recognized by others unless they import your certificate.
The not recognized by others part left me wondering. To me, X.509/PKI works a bit like OpenPGP: it has asymmetric cryptography, trust is built with certifications, etc.
Let's take a widely-trusted CA, for instance VeriSign. If signing a certificate asserts trust (= the root VeriSign cert signs the intermediate VeriSign cert, the latter becoming trusted too), then I have the following question:
Is it possible that a CA (like VeriSign) make another CA trusted (so that, for example, a CAcert-issued certificate would become valid and recognized in browsers, just by VeriSign signing the root/intermediate certificate of CAcert)?
Would that even work with self-signed certificates? Or do I wrongly understand X.509 and CAs cannot interact with each other?