is there a possibility to create a 2-Tier PKI with multiple CA's for redundancy?

enter image description here

The scenario would if, if CA1 becomes unavailable, CA2 could be used to verify certificates and/or the complete certificate chain.

  • Look into the cross-signed certificates and why they are used. This link will be helpful: security.stackexchange.com/questions/14043/…
    – saurabh
    Commented Oct 7, 2022 at 7:38
  • This looks good. If you post is as an answer, I can mark it as resolution
    – Rage
    Commented Oct 7, 2022 at 8:11
  • Don't know why the question is closed. The referenced answer does not seem to be very specific to the question asked, i.e. What if one of the CA is unavailable? Although it indirectly answers the question but still not specific to this question. Cross-Signed cert is one way to answer it, but does not cover all the use cases.
    – saurabh
    Commented Oct 7, 2022 at 10:00
  • What does 'unavailable' mean? If you simply mean offline or temporarily down, that has no effect on cert validation, because cert validation doesn't require communicating with the CA. It does, usually, involve either a CRL, which can have been issued days or months earlier, or an OCSP responder, which can be the CA but can instead be delegated or even entirely separate. Only if the cert of a CA (e.g. CA1) is expired or revoked does it affect validation, and in the former case a different cert for the same CA and key could be used but not a cert for a different CA. Commented Oct 8, 2022 at 1:11


Browse other questions tagged .