0

I'm using Google CA Service Provider in the Google Cloud to issue key materials on their FIPS-140-2 Level 3 HSMs (google's service). I intend to send the attestation bundle alongside public keys and other proofs as a CSR to a 3rd party Trust Provider, and get back certificates that are in the chain of trust.

I was wondering if I can use my CA as Issuer and thus have my ICA hosted by GC automatically in the CoT. In other words, I would like the 3rd party provider to sign the certificate I myself emit, and not just the Public keys I have on HSM (in which case, my CA will be next to last in the Chain, the last being the 3rd party provider of trust - which is in the AATL which is really what we're after). Is this a standard usecase, do you think?

Or is it better to simply take my ICAs public key and have it signed by the Trust Provider of my choosing (in which case my ICA will be last in chain)? This will give me the advantage that the certificate will be issued by my ICA, and further up one level I would have an AATL provider CA in the chain.

What do you guys think? And please recommend me some literature (other than RFC 5280, ITU-T and ISO and Webtrust Criteria - of which I am currently engorging on, hehe). I'd love to learn more about best practices in the Chain of Trust.

1 Answer 1

1

If your clients are public

I would like the 3rd party provider to sign the certificate I myself emit

There is no such thing as signing a certificate. A certificate is either trusted or not. If you establish you own CA as an intermediate CA of some big CA, then any certificate you issue will be trusted by any party in the world.

take my ICAs public key and have it signed by the Trust Provider of my choosing

A certificate is, simply put, a signed confirmation of specific properties of public key (whom this key belongs, for what purposes can this key be used, how long it is valid, etc.) There is no certificate for certificate.

A certificate of your CA must contain an attribute "Certification Authority". You specify this attribute in your CSR when you send it to a CA for signing. But a CA will not issue you a certificate confirming that you are a CA just because you want that.

Any CA can issue certificates for any domains, organizations, persons. That's why it requires a lot of trust to become a CA. See requirements on CAs:

The most requirements for root CA are valid also for intermediate CAs. Before you can establish your own intermediate CA, you will have to meet a lot of requirements.

If your clients are private

If you have full control on all your client devices, you can establish your own root CA. It will use a self-signed certificate. You put this root certificate on all your devices and thus make your root CA trusted on all your devices.

Then this root CA can issue certificates. All of them will be trusted on your devices, because they trust your root CA. Depending on risks that you have, you can establish intermediate CA and use it instead of root CA to issue certificates for your devices.

3
  • A certificate is either trusted or not. Well more or less. The trust is given by the peer and all systems do not trust the same certificates. A default JVM trusts nothing. A default Firefox trusts the Mozilla lists of root CA. A default Edge trusts the Microsoft lists of root CA. What I mean is that there is no central authority, even if Mozilla has a dominant position and pretends to be that. What about the pseudo CA used by anti-virus software? That are not in the official Mozilla list, but will be trusted by your Firefox installation after you install the anti-virus application... Commented Feb 28, 2023 at 13:18
  • A default JVM trusts nothing - This is not true. JVM uses by default the trust store that is a part of Java distribution.
    – mentallurg
    Commented Feb 28, 2023 at 19:02
  • A default Firefox trusts the Mozilla lists of root CA. - Exactly. That is what the links say that I provided in the answer.
    – mentallurg
    Commented Feb 28, 2023 at 19:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .