0

We have generated an internal root Certificate Authority for our organization and added X509v3 Name Constraints for our domain (example.com)

We issued a number of certificates for servers under that domain.

Now, we have a second domain (example.net) and want to issue internal certificates for hosts under that name.

Can I adjust the X509v3 Name Constraints on a CA without invalidating all the certificates that CA has issued, or do I need to create a new CA?

Improve this question
2

1 Answer 1

Reset to default
3

A certificate can not be modified and this includes a CA certificate. But you can issue a new CA certificate with the same subject (and subject key identifier) and the same public key but with different name constraints. Since subject and public key are the same this CA can then be used in place of the previous CA to verify previously issued certificates.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .