Timeline for Can a certification authority sign another CA's certs?
Current License: CC BY-SA 3.0
9 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Sep 20, 2015 at 10:40 | comment | added | Diti | Apparently, the new "Let's Encrypt" CA's certificates are cross-signed by another CA. So it really is possible. | |
| May 18, 2014 at 16:41 | comment | added | AJ Henderson | @diti all that matters is chain of authority. If the signatures chain back to a trusted cert then it will be trusted. The only time there would be some variability is that some programs don't check valid subjects to be signed if there are some restrictions on the cert. | |
| May 18, 2014 at 16:33 | vote | accept | Diti | ||
| May 18, 2014 at 16:33 | comment | added | Diti | I am choosing this as the accepted answer because of what I read in the comments (about real use); still, there is a small part of the question not yet answered: how about validity/recognition (by software) of such cross-signed "root certs"? | |
| May 13, 2014 at 13:20 | comment | added | AJ Henderson | @LarryK - thanks for pointing that out. That is why I said "to the best of my knowledge" since I hadn't particularly gone looking, but I knew most didn't. I have updated my answer accordingly. Please let me know if you think there are any additional changes that would improve it or feel free to suggest an edit to the answer. | |
| May 13, 2014 at 11:01 | history | edited | AJ Henderson | CC BY-SA 3.0 |
added 164 characters in body
|
| May 13, 2014 at 6:10 | comment | added | Larry K | -1 "To the best of my knowledge, no CA offers this kind of service, nor do I see any reason why they would consider doing so in the future." Completely incorrect. We do this with some CAs. A security/business process is set up and agreed prior to generating the individual signer certs that are subordinate to the CA's cert. Eg the customer's security department agrees to a procedure for authenticating the humans' identity prior to generating a cert. (I couldn't edit my prior comment.) | |
| May 13, 2014 at 6:04 | comment | added | Larry K | Wrong: "To the best of my knowledge, no CA offers this kind of service, nor do I see any reason why they would consider doing so in the future." We do this with some CAs. A security/business process is set up and agreed prior to generating the certs. | |
| May 12, 2014 at 14:18 | history | answered | AJ Henderson | CC BY-SA 3.0 |