Timeline for How does a client know an SSL cert has been signed by a CA if the client doesn't have the CA's public key?
Current License: CC BY-SA 3.0
11 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 31, 2018 at 10:34 | review | Suggested edits | |||
| Oct 31, 2018 at 10:56 | |||||
| Aug 22, 2017 at 12:46 | comment | added | user541686 | There's a 4th scenario that's kind of like scenario #3 except not quite. Windows automatically downloads missing root certificates, and (I assume) verifies them against Microsoft's own root certificate. So it's neither already trusted by the client nor sent by the server. | |
| Aug 22, 2017 at 9:44 | comment | added | Martin Bonner supports Monica | @Voo : Usually (?always?) buried inside a hardware security module and needing multiple smartcards to be presented to enable the use of the root key. | |
| Aug 21, 2017 at 20:33 | comment | added | Voo | (In practice I'd hope that every CA has the private keys of their root CAs in cold storage somewhere with stringent security requirements for the very rare use cases where you need it to actually create new intermediate certs). | |
| Aug 21, 2017 at 20:29 | comment | added | Voo | @Mark And the reason for those intermediate certificates is that you need the private key of your CA certificate if you want to create/sign new certificates. Since root certificates are generally valid for a long time (some devices that rely on them just can't easily be updated) it's best to minimize their exposure. If an intermediate certificate is leaked you can revoke it via its root CA, then create a new intermediate certificate and use that to sign new certificates. If a root CA is leaked you have a much bigger problem on your hands, since you cannot revoke it automatically. | |
| Aug 21, 2017 at 19:33 | comment | added | Mark Amery | Ah - so that's what all this malarky about "intermediate" certificates and the certificate "chain" is for, then! And why when I don't follow my CA's instructions to include intermediate certificates when configuring my webserver, some clients can connect successfully and others show certificate errors. As a dumb web developer who has always just mindlessly and uncomprehendingly followed the instructions I was given when setting up SSL, reading this answer has left me suddenly enlightened. | |
| Aug 21, 2017 at 16:07 | vote | accept | User314159 | ||
| Aug 21, 2017 at 11:44 | comment | added | LvB | which is why I just added as a comment and upvoted your awnser ;) | |
| Aug 21, 2017 at 10:35 | comment | added | psmears | @LvB: Yeah, I was trying not to go to deeply into the technical details :) | |
| Aug 21, 2017 at 10:31 | comment | added | LvB |
To be specific your certificate needs the X509v3 Basic Constraints: CA:TRUE inside it or the 'X509v3 Key Usage: Certificate Sign, CRL Sign' property.
|
|
| Aug 21, 2017 at 10:12 | history | answered | psmears | CC BY-SA 3.0 |