I have a certificate issued from Let's Encrypt.

Can I create a key and certificate for my own purpose (i.e. an OpenVPN server, or web server with internal domain name/IP address) and sign it with the Let's Encrypt certificate?


1 Answer 1


Usually no, only certificates marked as being a CA can issue certificates. (or, more accurately, you can do that, but no vpn client or web browser will trust it.)

To see if your certificate is a CA, open it and look at the Basic Constraints field; a CA will look like this

CA Basic Constraints

while an End Entity will look like this:

End Entity Basic Constraints

End Entities are not allowed to issue certs, and good luck getting Let's Encrypt to give you a CA cert...

  • 3
    In some cases you can purchase a signed subordinate CA certificate from public CA. This process is called "certification authority root signing": sysadmins.lv/blog-en/certification-authority-root-signing.aspx
    – Crypt32
    Aug 1, 2018 at 15:01
  • 3
    @Crypt32 Interesting, thanks! That Requirements section though: "Your PKI must use Hardware Security Modules", "your company will have to pass annual external audits" is basically forcing you to follow the same rules as any other publicly-trusted CA. Aug 1, 2018 at 15:45
  • 3
    Yes, it is. The only difference is that you don't have to bother with your CA inclusion in various trust lists (Microsoft, Mozilla, etc.), because the trust is established via public CA provider that offers you qualified subordinate CA.
    – Crypt32
    Aug 1, 2018 at 15:58
  • 1
    @MikeOunsworth Issuing a CA certificate constraint to a domain would make sense as an alternative to wildcard certificates. I think it's even part of the spec, but browsers don't support it. Aug 1, 2018 at 18:48
  • 3
    @MikeOunsworth Just like there is a flag in the cert which determines if a cert can act as CA, you can also have fields limiting the domain. It's part of the x.509 spec - name constraints, but browsers don't support it. Aug 1, 2018 at 19:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .