I've observed the practice of generating dedicated issuer CAs for signing TSU (Time-Stamping Unit) certificates instead of just using another existing issuer CA, for example, one used to sign S/MIME certificates or SSL certificates.
Now, some examples of the certification paths I found around:
- CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US - CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US - CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US - CN=Chambers of Commerce Root,OU=http://www.chambersign.org,O=AC Camerfirma SA CIF A82743287,C=EU - CN=AC Camerfirma TSA CA,O=AC Camerfirma SA,serialNumber=A82743287,L=Madrid (see current address at www.camerfirma.com/address),emailAddressfirstname.lastname@example.org,C=ES - CN=Certificado TSU GSD,O=GSD SAC,L=Lima,emailAddressemail@example.com,C=PE - CN=Global Chambersign Root - 2008,O=AC Camerfirma S.A.,serialNumber=A82743287,L=Madrid (see current address at www.camerfirma.com/address),C=EU - CN=AC Camerfirma Portugal - 2015,L=Madrid (see current address at www.camerfirma.com/address),serialNumber=A82743287,O=AC Camerfirma S.A.,C=ES - CN=DigitalSign Primary CA,L=Guimaraes (see current address at www.digitalsign.pt),serialNumber=PT507015851,O=DigitalSign Certificadora Digital,C=PT - CN=DigitalSign TSA CA,O=DigitalSign Certificadora Digital,L=Guimaraes (see current address at www.digitalsign.pt),C=PT,serialNumber=PT507015851 - CN=SigningHub Timestamping Service,OU=SigningHub Cloud Service,O=Ascertia Ltd,C=GB
Where you can find in all of these cases that the name of the issuing CA suggests that it is dedicated for signing TSU certificates.
Now, I see a valid point for this practice in https://security.stackexchange.com/a/109134/10247, where it says:
Using different intermediate CAs will allow you to differentiate end-entity certificates by their issuer. This makes it possible to create trust rules that will limit certificate usage based on their issuer.
But I haven't seen until now the need for any relying party to configure a CA to be trusted only to issue TSU certificates (instead of just relying on their generally trusted CAs to correctly identify TSU certificates with the EKU). Anyway, maybe this practice is more common than what my experience dictates and in that case, have you experienced the need for this before?.
Now, in addition to the previous, do you know of any other reason that could justify generating a dedicated issuer CA just for signing TSU certificates?.