I have imported a CA into Chrome, and I am signing my own cert with the CA's private key. Obviously, I need the
Common Name of the Issuer on my Cert to be the same as the
Common Name of the subject of the CA.
I am trying to understand which other fields need to match for the browser to trust that my cert was signed by the right CA? Does every field need to match exactly? Do the two public certs need to have the same extensions installed? Does the signatureAlgorithm need to match? Is this documented somewhere?
The CA will be self-signed, so actually its issuer and subject will be identical (I believe).
Will browsers ignore certs that are valid for too long? What if I make the CA cert valid for 50 years? What if the cert is coming from an HTTPS proxy instead of an HTTPS website?