Timeline for Creating sub CA signed with Let's Encrypt certificate
Current License: CC BY-SA 4.0
19 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Dec 11, 2019 at 15:31 | comment | added | Tyeth | It's worth noting you can also specify which CAs should be supported for a domain via CAA dns entries en.wikipedia.org/wiki/DNS_Certification_Authority_Authorization | |
| Aug 1, 2018 at 23:57 | comment | added | user71659 | @MikeOunsworth One possible reason: adds another certificate to the hierarchy (Root CA, Intermediate CA, Constrained CA, Server Certificate), versus (Root CA, Intermediate CA, Wildcard Cert), so more overhead. Or you can issue the constrained CA directly from the root CA, (like Google's CA), but root CAs are kept offline and access is separated, so you'd need to get people together and have a signing ceremony (slow and expensive). | |
| Aug 1, 2018 at 22:21 | comment | added | Mike Ounsworth | @mbrig It sounds like it did make it into the basic spec, but browsers chose not to implement it because .... then managing the root cert trust list becomes more of an auditing nightmare? .... then how would CAs make money? .... some other reason that favours one CA issuing wildcard certs vs each webmaster issuing their own certs? | |
| Aug 1, 2018 at 22:15 | comment | added | mbrig | @CodesInChaos perhaps its just the benefit of hindsight, but it seems like that use-case ("give someone the ability to sign anything they want, within a limited domain") should have made it into the base design. | |
| Aug 1, 2018 at 19:56 | comment | added | Mike Ounsworth | @CodesInChaos NICE! I was not aware of that extension. ++ | |
| Aug 1, 2018 at 19:52 | comment | added | CodesInChaos | @MikeOunsworth Just like there is a flag in the cert which determines if a cert can act as CA, you can also have fields limiting the domain. It's part of the x.509 spec - name constraints, but browsers don't support it. | |
| Aug 1, 2018 at 19:35 | comment | added | Mike Ounsworth | @grawity See my answer to Codes. Letting DigiCert host your semi-private CA for you makes sense since they are already set up for WebTrust compliance and can enforce domain restrictions at their end. | |
| Aug 1, 2018 at 19:34 | comment | added | Mike Ounsworth |
@CodesInChaos the main concern that comes to mind is domain restriction; what's to stop a domain/CA cert for mycorp.com from issuing themselves a cert for google.com? I have to imagine that any scheme where a company can issue themselves publicly-trusted certs would need some kind of public scrutiny / auditing mechanism.
|
|
| Aug 1, 2018 at 18:57 | comment | added | grawity | @MikeOunsworth: A common (and increasingly required) alternative is to let the root CA itself host your sub-CA. Then you use the provided APIs (or a web panel like DigiCert's "CertCentral") to issue all certificates; which in the end is very similar to how Let's Encrypt works. | |
| Aug 1, 2018 at 18:48 | comment | added | CodesInChaos | @MikeOunsworth Issuing a CA certificate constraint to a domain would make sense as an alternative to wildcard certificates. I think it's even part of the spec, but browsers don't support it. | |
| Aug 1, 2018 at 16:57 | comment | added | Mike Ounsworth | @PeterMortensen umm, I used Firefox. Openssl can pretty-print certs,, and I have yet to meet a platform that doesn't support openssl. | |
| Aug 1, 2018 at 16:55 | comment | added | Peter Mortensen | Re "... open it and look ...": Presuming a particular platform? | |
| Aug 1, 2018 at 15:58 | comment | added | Crypt32 | Yes, it is. The only difference is that you don't have to bother with your CA inclusion in various trust lists (Microsoft, Mozilla, etc.), because the trust is established via public CA provider that offers you qualified subordinate CA. | |
| Aug 1, 2018 at 15:45 | comment | added | Mike Ounsworth | @Crypt32 Interesting, thanks! That Requirements section though: "Your PKI must use Hardware Security Modules", "your company will have to pass annual external audits" is basically forcing you to follow the same rules as any other publicly-trusted CA. | |
| Aug 1, 2018 at 15:01 | comment | added | Crypt32 | In some cases you can purchase a signed subordinate CA certificate from public CA. This process is called "certification authority root signing": sysadmins.lv/blog-en/certification-authority-root-signing.aspx | |
| Aug 1, 2018 at 13:51 | comment | added | Mike Ounsworth | Yeah. Cynically, how would CAs make money if you only need to buy one cert and then can issue as many as you want? Less cynically, If you could issue certs off their Root CA like that, then they are legally responsible for any fraudulent certs you make, why would they let you do that? | |
| Aug 1, 2018 at 13:49 | vote | accept | Kamil K | ||
| Aug 1, 2018 at 13:49 | comment | added | Kamil K | I suspected there is some kind of limitation like this. Thank you. | |
| Aug 1, 2018 at 13:35 | history | answered | Mike Ounsworth | CC BY-SA 4.0 |