I have a self-signed CA that I want to rotate the key for. I want to use cross-signing to facilitate this, with gradual replacement of the certificate on the clients so they can still communicate.
I'm using cfssl, but can't figure out practically how to get this to work. For testing purposes I've generated two new CAs with identical CNs and cross-signed them:
cfssl gencert -initca ca-csr-A.json | cfssljson -bare ca-A cfssl gencert -initca ca-csr-B.json | cfssljson -bare ca-B cfssl sign -ca ca-A.pem -ca-key ca-A-key.pem -config ca-config.json ca-B.csr | cfssljson -bare ca-B-by-A cfssl sign -ca ca-B.pem -ca-key ca-B-key.pem -config ca-config.json ca-A.csr | cfssljson -bare ca-A-by-B
I've then created a new client certificate, signed with A's private key and the A certificate cross-signed by B:
cfssl gencert -ca=ca-A-by-B.pem -ca-key=ca-A-key.pem -config=ca-config.json child-csr.json | cfssljson -bare child
I've then tried to verify (using
openssl verify) the new client certificate with either original A, original B or either of the cross-signed CAs, but can't work out the incantation. I've tried bundling
ca-B.pem, and tried bundling the client with
ca-A-by-B.pem as an intermediary, but they don't work either.
I think I missing something obvious, or just misunderstanding cross-signing completely. Is this even possible?