0

I have imported a CA into Chrome, and I am signing my own cert with the CA's private key. Obviously, I need the Common Name of the Issuer on my Cert to be the same as the Common Name of the subject of the CA.

I am trying to understand which other fields need to match for the browser to trust that my cert was signed by the right CA? Does every field need to match exactly? Do the two public certs need to have the same extensions installed? Does the signatureAlgorithm need to match? Is this documented somewhere?

The CA will be self-signed, so actually its issuer and subject will be identical (I believe).

Will browsers ignore certs that are valid for too long? What if I make the CA cert valid for 50 years? What if the cert is coming from an HTTPS proxy instead of an HTTPS website?

Improve this question
5
  • 3
    I would strongly suggest to use specialized CA software for this. For example, ADCS on Windows, EJBCA (crossplatform) or XCA (MacOS). Don't roll your own CA implementation it will be worse than industry-proven solutions. CA will automatically handle fields and extensions in issued certificates.
    – Crypt32
    Commented Mar 26, 2019 at 18:28
  • 3
    if you want to learn the subject, then RFC5280 (tools.ietf.org/html/rfc5280) is your best friend.
    – Crypt32
    Commented Mar 26, 2019 at 18:32
  • Hi @Crypt32 -- I am not trying to implement this myself, but to understand the behavior in the tools that I have. Thank you!
    – Plastic Soul
    Commented Mar 26, 2019 at 19:11
  • 3
    As @Crypt32 said, you should read RFC 5280, specifically Section 6: Certification Path Validation tools.ietf.org/html/rfc5280#section-6 It is the documentation you were asking for in your question.
    – John Deters
    Commented Mar 26, 2019 at 19:23
  • 1
    I consider this question as too broad. I can see at least 3 different and mostly independent questions here: which fields in CA and cert need to be aligned and where is the specification for this, will browsers ignore certs with an expiration too long in the future, it is relevant for verification if this the original cert or one created by a proxy. Please split up this question so that these parts can be answered separately.
    – Steffen Ullrich
    Commented Mar 27, 2019 at 7:25

1 Answer 1

Reset to default
1

Not going to answer the question directly, because I consider it too broad, but I'm going to give some advice.

If you want to clearly understand how certificates work, you will have to develop your learning path. Which will include:

  • PKI Fundamentals. Hierarchies, components, trust anchors. Wikipedia materials will be sufficient to understand basic concepts.
  • X.509 profile. Certificate structure and contents: mandatory fields and v3 extensions. These topics are greatly explained in RFC5280 §§1-5
  • Certificate chaining engine. For start I would recommend something less sophisticated. For example, my own blog post: Certificate Chaining Engine — how it works. Although, it is Microsoft-specific, but general concepts are still universal.
  • Understand constraints in details: Basic Constraints, Name Constraints, Certificate Policies. RFC5280 §4.2.
  • Detailed (and a bit sophisticated) abstract certificate chain building and validation algorithm in RFC5280 §6.
  • Explore Internet PKI regulatory organizations. Learn about CA/B Forum and their Baseline Requirements. RFC is more about X.509 profile itself, while CA/B Forum is more about industry practices used in HTTPS/TLS applications.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .