Skip to main content
added 18 characters in body
Source Link
tylerl
  • 83.8k
  • 26
  • 154
  • 234

How long does this chain extend?

There is no specified limit, but clients (browsers, mail programs, etc) may have some internal limit as to how many hops they're willing to follow.

Can't I use X.com to sign a certificate for another domain, say Y.com. If no, why not? If yes, I don't see the purpose of signing.

No, since X.com's certificate is not marked as a signing certificate.

Or rather: yes, you could, the underlying technology doesn't prevent you from doing so. But browsers are programmed to check for the CA: true basic constraint for all signing and intermediate certificates, and will not trust the signature if that isn't true.

Convincing a CA to sign youran intermediate certificate for you is no small feat, since they're staking their reputation on the assertion that you will not sign anything that shouldn't be signed. Not a small guarantee.

How long does this chain extend?

There is no specified limit, but clients (browsers, mail programs, etc) may have some internal limit as to how many hops they're willing to follow.

Can't I use X.com to sign a certificate for another domain, say Y.com. If no, why not? If yes, I don't see the purpose of signing.

No, since X.com's certificate is not marked as a signing certificate.

Or rather: yes, you could, the underlying technology doesn't prevent you from doing so. But browsers are programmed to check for the CA: true basic constraint for all signing and intermediate certificates, and will not trust the signature if that isn't true.

Convincing a CA to sign your intermediate is no small feat, since they're staking their reputation on the assertion that you will not sign anything that shouldn't be signed. Not a small guarantee.

How long does this chain extend?

There is no specified limit, but clients (browsers, mail programs, etc) may have some internal limit as to how many hops they're willing to follow.

Can't I use X.com to sign a certificate for another domain, say Y.com. If no, why not? If yes, I don't see the purpose of signing.

No, since X.com's certificate is not marked as a signing certificate.

Or rather: yes, you could, the underlying technology doesn't prevent you from doing so. But browsers are programmed to check for the CA: true basic constraint for all signing and intermediate certificates, and will not trust the signature if that isn't true.

Convincing a CA to sign an intermediate certificate for you is no small feat, since they're staking their reputation on the assertion that you will not sign anything that shouldn't be signed. Not a small guarantee.

Source Link
tylerl
  • 83.8k
  • 26
  • 154
  • 234

How long does this chain extend?

There is no specified limit, but clients (browsers, mail programs, etc) may have some internal limit as to how many hops they're willing to follow.

Can't I use X.com to sign a certificate for another domain, say Y.com. If no, why not? If yes, I don't see the purpose of signing.

No, since X.com's certificate is not marked as a signing certificate.

Or rather: yes, you could, the underlying technology doesn't prevent you from doing so. But browsers are programmed to check for the CA: true basic constraint for all signing and intermediate certificates, and will not trust the signature if that isn't true.

Convincing a CA to sign your intermediate is no small feat, since they're staking their reputation on the assertion that you will not sign anything that shouldn't be signed. Not a small guarantee.