Consider the following scenario
OpenSSL and x.509v3 is used.
You have 2 CA's: CA1 and CA2. Both CA's have cross signed each other,
meaning CA1 has signed CA2 and CA2 has signed CA1.
When CA1 signed CA2, it added a CRL and OCSP entry into the certificate.
When CA2 signed CA1, it added a CRL and OCSP entry into the certificate.
CA1 issues a certificate to Subordinate CA1.
Subordinate CA1 issues an End-Entity certificate to Server1.
Server2 tries to authenticate Server1's certificate and sees that it is
signed by Subordinate CA1 which in turn is signed by CA1 which in turn
is signed by CA2. Both CA1 and CA2 is in Server2's trust store, so the
certificate is verified.
CA1's private key is compromised.
Server2 removes CA1 from its trust store.
Server2 tries to authenticate Server1's certificate and sees that is is
signed by Subordinate CA1 which in turn is signed by CA1 which in turn
is signed by CA2.
What action does Server2 take?
I would like to think that Server2 does not allow/verify Server1's certificate, because CA1 is no longer in the trust store. However, given that CA1 is cross signed by CA2, and CA2 is still in the trust store, one could argue that the chain of trust is still there (the fact that Server1 doesn't include CA1 in it's certificate bundle when connecting to Server2 might make Server2 decide to not verify it).
What if, in addition to removing CA1 from the trust stores, we also have CA2 revoke CA1 through its CRL and OCSP responder?
My fear is that by cross signing, my only option to take a compromised CA out of rotation is to take both the compromised CA and the CA that signed it out of rotation. Which would be... suboptimal...
