0

Given that one CA can issue another a certificate so that they can go on and do the same, what would stop someone from using the certificate for their website to issue certificates and become an intermediate authority?

I assume there is a difference in the certificates issued to CAs and those issued by CAs: if I am wrong, what stops someone from abusing their web certificate to incorrectly issue other certificates?

2

1 Answer 1

4

Given that one CA can issue another a certificate so that they can go on and do the same

The Basic Constraints extension can indicate that a CA cert is not allowed to issue any other CA certs, so not all CAs can create additional CAs.

what would stop someone from using the certificate for their website to issue certificates and become an intermediate authority

The main purpose of the Basic Constraints extension is to indicate something is, or isn't, a CA (absent a Basic Constraints extension the answer is "well, it's a CA if it's self-signed"). Additionally, the issuing CA shouldn't give an end-entity certificate the KeyCertSign usage in the Key Usage extension, which is required for a CA.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .