I work in an organization which is employing what I believe to be a non-standard and problematic PKI system for internally used certificates.
They issue multiple root certificates and intermediate certificates with the same subject name with different validity periods. The public keys are also different.
When I look up an Issuer Name it gives a subject which could match multiple different certs. Some underlying implementation must be determining which cert is the actual issuer.
OpenSSL hashes certificates according to their subject and installs them in a particular place. It does allow duplicate hashes and creates multiple sym links.
I think we have faced problems in dealing with these multiple root and intermediate certs on servers. Sometimes deleting an unused expiring cert has caused TLS to fail. I don't know if this because of this re-using of subject lines and a problem with OpenSSL getting some order messed up. Or it is some other issue and this duplicate subjects for root and intermediate certs is normal.
I would appreciate any feedback on this. I searched the RFC document and saw this but found it confusing because it refers to a subject entity which I assume is the real world entity. So I believe this says you can issue multiple certs for the same real world entity with the same subject. Which is fine. But my question is around intermediate issuer certs.
Where it is non-empty, the subject field MUST contain an X.500 distinguished name (DN). The DN MUST be unique for each subject entity certified by the one CA as defined by the issuer field. A CA MAY issue more than one certificate with the same DN to the same subject entity.