0

I am really new into security and much more confused with the concepts going on, regarding the CA. Let's assume the following exists in a system:

         TA
          |
       CA_MID
     /        \
  CA_INT1   CA_INT2
    /|\        /|\
END_ENTn1   END_ENTn2

The topmost CA is the trust anchor. CA_MID is an intermediate CA issuing only certs to other CAs. CA_INT1 and CA_INT2 are CA that issue certs to end entities, laptops(CA_INT1) and desktops(CA_INT2). Suppose I have a laptop(END_ENTn1) which has imported the chain TA, CA_MID, CA_INT1.

1st question: In order to communicate with a desktop, should I also import the CA_INT2 to my laptops Trust Store?

2nd question: Is there an option that desktop will include in his certificate whole it's chain (TA, CA_MID, CA_INT2) so that a laptop can verify that they both belong to the same trust anchor so I don't have to import CA_INT2 to the laptops store?

3rd question: Is it possible to have communication between laptop and desktop when laptop has imported all the CAs (TA, CA_MID, CA_INT1, CA_INT2) and the desktop has only it's chain (TA, CA_MID and CA_INT2) imported? In this case I believe the communication can be only one way, am I right?

Thank you very much.

1 Answer 1

0

1st question: In order to communicate with a desktop, should I also import the CA_INT2 to my laptops Trust Store?

not to Trust Store, but to a store where certificate chaining engine will search for missing intermediate certificates. Trust Store is supposed to store trust anchors (which are usually a self-signed certificates. In your case it is TA). This step may not be necessary if CA_INT2 provides information about its own certificate location in Authority Information Acess (AIA) extension. In this case, laptop will be able to fetch CA_INT2 certificate from presented desktop's certificate. It is a common and good practice to include AIA extension in all certificates to make it easier to obtain missing intermediate CA certificates.

2nd question: Is there an option that desktop will include in his certificate whole it's chain (TA, CA_MID, CA_INT2) so that a laptop can verify that they both belong to the same trust anchor so I don't have to import CA_INT2 to the laptops store?

as was stated in the first answer, intermediate CA certificate can be obtained dynamically. However, in regards to this question: it depends. Depending on a communication protocol, server may send entire chain (except for root certificate) or leaf certificate only and you can't change this behavior. For example, when using HTTP over SSL/TLS, leaf and all intermediate certificates are sent to client. When using RDP over SSL/TLS, or using SSTP VPN, only leaf certificate is sent to client.

3rd question: Is it possible to have communication between laptop and desktop when laptop has imported all the CAs (TA, CA_MID, CA_INT1, CA_INT2) and the desktop has only it's chain (TA, CA_MID and CA_INT2) imported? In this case I believe the communication can be only one way, am I right?

again, if intermediate certificates can be obtained dynamically (via AIA extension, underlying protocol or other available means), then everything will be ok.

10
  • what about the situation where there are more than one intermediates in the chain? Will I have in every single intermediate cert the information in AIA about where is the next one in the chain? or can I have all the intermediates location included in the laptop cert AIA?
    – JamieFraud
    Commented Oct 17, 2017 at 20:23
  • Yes, AIA should be presented in every non-root certificate. It contains information about how to obtain issuer certificate. You can't add all issuers in one certificate. Each issuer includes its own cert location in AIA in certs it issues.
    – Crypt32
    Commented Oct 17, 2017 at 20:43
  • One more thing, when starting that TLS handshake, from laptop (client) to desktop (server), should the server be aware of the intermediates CA of the client? Because from what I understand, server provides whole the chain to the client, so the client finds out that the anchor is the same as it's own, there should be a handshake made even thought that server does know nothing about the intermediates of the client, right?
    – JamieFraud
    Commented Oct 17, 2017 at 20:49
  • Server sends to client its certificate and intermediate certificates. Server don’t care about client configuration at all, it’s solely up to client. If client decides to continue, the handshake continues, if not — the connection is closed.
    – Crypt32
    Commented Oct 17, 2017 at 20:52
  • In situation that client want to have access to servers resources, client is the initiator of the handshake, and if the TA of the server is found in client's trust store then the connection is established and the client trusts the server. For the server to send the data to the client shouldn't the server trust the same way the client?
    – JamieFraud
    Commented Oct 17, 2017 at 20:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .