I'm trying to create an environment with cross-signed CAs, and verify a certificate issued against one of the CAs, all using
openssl. The best I got so far is getting
openssl into an endless loop while verifying (the loop is terminated at level 100).
- There should be 4 certificates, self-signed from authorities #1 and #2, and cross-signed, where authority #1 is signed by authority #2 and vice versa.
- There are only 2 actual subjects (DNs) used (the same subject used by an authority for self-signed is what it has signed by the other authority, albeit in a different cert).
- All 4 certificates should be the part of the end-user trust.
- The keys used by the same authority, for both self- and cross- signed certificates should be the same
- AKI should not be used (May be "shouldn't" is too of a strong word, but not using it shouldn't hurt. Because of the same keys rule, it shouldn't matter though)
- I tried setting CA:TRUE for cross-signed certs, with the same result.
My understanding of cross-signing, is that it gives the verification process alternative paths. Considering that I see
openssl loop, it seems to be picking cross-signed certificates every time. So the crux of the question is - what would make the verification process to favor the self-signed certificate over the cross-signed one, considering both have the same subject.
Here is a test leaf certificate, I can't make
openssl verify to verify it successfully.
[vps@druid]~/ws/EF/pki3$ openssl verify -verbose -CAfile cas.pem cert.pem cert.pem: C = US, O = Excelfore, OU = PoC, CN = xl4 CA 2 error 2 at 100 depth lookup:unable to get issuer certificate