I have a certificate issued from Let's Encrypt.
Can I create a key and certificate for my own purpose (i.e. an OpenVPN server, or web server with internal domain name/IP address) and sign it with the Let's Encrypt certificate?
-
1Dupe security.stackexchange.com/questions/20513/… security.stackexchange.com/questions/33649/… security.stackexchange.com/questions/65150/… security.stackexchange.com/questions/103685/…– dave_thompson_085Commented Aug 1, 2018 at 20:33
Add a comment
|
1 Answer
Usually no, only certificates marked as being a CA can issue certificates. (or, more accurately, you can do that, but no vpn client or web browser will trust it.)
To see if your certificate is a CA, open it and look at the Basic Constraints field; a CA will look like this
while an End Entity will look like this:
End Entities are not allowed to issue certs, and good luck getting Let's Encrypt to give you a CA cert...
answered Aug 1, 2018 at 13:35
-
3In some cases you can purchase a signed subordinate CA certificate from public CA. This process is called "certification authority root signing": sysadmins.lv/blog-en/certification-authority-root-signing.aspx– Crypt32Commented Aug 1, 2018 at 15:01
-
3@Crypt32 Interesting, thanks! That Requirements section though: "Your PKI must use Hardware Security Modules", "your company will have to pass annual external audits" is basically forcing you to follow the same rules as any other publicly-trusted CA. Commented Aug 1, 2018 at 15:45
-
3Yes, it is. The only difference is that you don't have to bother with your CA inclusion in various trust lists (Microsoft, Mozilla, etc.), because the trust is established via public CA provider that offers you qualified subordinate CA.– Crypt32Commented Aug 1, 2018 at 15:58
-
1@MikeOunsworth Issuing a CA certificate constraint to a domain would make sense as an alternative to wildcard certificates. I think it's even part of the spec, but browsers don't support it. Commented Aug 1, 2018 at 18:48
-
3@MikeOunsworth Just like there is a flag in the cert which determines if a cert can act as CA, you can also have fields limiting the domain. It's part of the x.509 spec - name constraints, but browsers don't support it. Commented Aug 1, 2018 at 19:52