I have obtained a certificate from GoDaddy. It's usage and constraints are as follows:
Digital Signature, Key Encipherment (a0)
Enhanced Key Usage:
Server Authentication (126.96.36.199.188.8.131.52.1) Client Authentication (184.108.40.206.220.127.116.11.2)
Subject Type=End Entity Path Length Constraint=None
Using OpenSSL, I am able to use this certificate as a CA and sign certificates. Of course, using the certificate signed by the fake CA gives errors in all browsers.
My question, is this a bug in OpenSSL? Can this be used as an exploit?
I read up on CVE-2015-1793 which focuses more on the alternative chain validation than the ability of OpenSSL to sign certificate using a non-CA certificate.
Thanks for any help.