Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Given that one CA can issue another a certificate so that they can go on and do the same, what would stop someone from using the certificate for their website to issue certificates and become an intermediate authority?
I assume there is a difference in the certificates issued to CAs and those issued by CAs: if I am wrong, what stops someone from abusing their web certificate to incorrectly issue other certificates?
Given that one CA can issue another a certificate so that they can go on and do the same
The Basic Constraints extension can indicate that a CA cert is not allowed to issue any other CA certs, so not all CAs can create additional CAs.
what would stop someone from using the certificate for their website to issue certificates and become an intermediate authority
The main purpose of the Basic Constraints extension is to indicate something is, or isn't, a CA (absent a Basic Constraints extension the answer is "well, it's a CA if it's self-signed"). Additionally, the issuing CA shouldn't give an end-entity certificate the KeyCertSign usage in the Key Usage extension, which is required for a CA.
k, m, and n.
