9

I have a certificate issued from Let's Encrypt.

Can I create a key and certificate for my own purpose (i.e. an OpenVPN server, or web server with internal domain name/IP address) and sign it with the Let's Encrypt certificate?

16

Usually no, only certificates marked as being a CA can issue certificates. (or, more accurately, you can do that, but no vpn client or web browser will trust it.)

To see if your certificate is a CA, open it and look at the Basic Constraints field; a CA will look like this

CA Basic Constraints

while an End Entity will look like this:

End Entity Basic Constraints

End Entities are not allowed to issue certs, and good luck getting Let's Encrypt to give you a CA cert...

  • 3
    In some cases you can purchase a signed subordinate CA certificate from public CA. This process is called "certification authority root signing": sysadmins.lv/blog-en/certification-authority-root-signing.aspx – Crypt32 Aug 1 '18 at 15:01
  • 3
    @Crypt32 Interesting, thanks! That Requirements section though: "Your PKI must use Hardware Security Modules", "your company will have to pass annual external audits" is basically forcing you to follow the same rules as any other publicly-trusted CA. – Mike Ounsworth Aug 1 '18 at 15:45
  • 3
    Yes, it is. The only difference is that you don't have to bother with your CA inclusion in various trust lists (Microsoft, Mozilla, etc.), because the trust is established via public CA provider that offers you qualified subordinate CA. – Crypt32 Aug 1 '18 at 15:58
  • 1
    @MikeOunsworth Issuing a CA certificate constraint to a domain would make sense as an alternative to wildcard certificates. I think it's even part of the spec, but browsers don't support it. – CodesInChaos Aug 1 '18 at 18:48
  • 3
    @MikeOunsworth Just like there is a flag in the cert which determines if a cert can act as CA, you can also have fields limiting the domain. It's part of the x.509 spec - name constraints, but browsers don't support it. – CodesInChaos Aug 1 '18 at 19:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.