I have two self signed root CA that was used for separate kubernetes clusters (say cluster A and B). Both CA is used to sign application certs in their respective cluster.

However, one of the application inside cluster A needs to access another application in cluster B which require a client cert authentication. The application in cluster B can be configured to trust some CA cert, which by default is trusting root CA of cluster B.

My initial Idea is to have a cross signed intermediate CA which will be trusted by the application inside cluster B. This intermediate CA will be cross signed using root CA from cluster A and root CA from cluster B. Is there a way for me to do it ? Will the application trust the cert from cluster A which is signed solely by root CA of cluster A?

  • 1
    If there's one application in cluster A why not simply give that application a Client Authentication certificate from the CA of cluster B? – garethTheRed Jul 11 '19 at 11:36
  • We are using auto cert signing and the application also has an auto scaling mechanism. Every time a new app is scaled, it will create a new auto cert request. The auto cert will sign a new cert based on respective cluster CA, so thats why the cert will be different – Reynaldi Wijaya Jul 12 '19 at 1:42
  • Add cluster A's Root CA certificate to the trust-anchor store of the relevant application(s) running on cluster B? It will mean that these applications will trust all certificates issued by cluster A, but that may be acceptable to your security posture. – garethTheRed Jul 12 '19 at 5:49
  • Yes that is one way to do and we are fine since both cluster is trustable and private anyway. However, the apps can only trust one ca file (from 3rd party), and thats why I am thinking to use cross signed intermediate CA so it can represent both CA. Does it work the way I think it works? If i only trust the A root CA then the B root CA is not trustable by the app – Reynaldi Wijaya Jul 12 '19 at 6:35
  • It may only trust one file, but usually that file can contain many certificates in PEM format. – garethTheRed Jul 12 '19 at 8:33

Yes, cross signing is possible.

What you need to do is let A sign a CA certificate which

  • uses the same key as B
  • uses the same subject as B

(and vice versa). If those intermediate certificates are made available, then there are two possible chains for each end entity certificate signed by either A or B which end in either of your roots.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.