I am just trying to get the basics of PKI and TLS and understand how it works. I came across Mozillas post about pkix where they mention that the new library allows graph processing and hence it handles cross-signed certificates, which is difficult via prior libraries since they use trees. This also removes the requirement of using AKI (authority key info).

Can anyone please elaborate what this means, what cross-signing is and details about AKI ?




Authority Key identifier which is one of the certificate extension in PKI , through which we can identify the CA public key hash. It can be 160bit hash or 60 bit hash depends upon the CA who signs the certificate.

Cross - signing :

When cross-signing is implemented, the certificates are logically chained to the trusted

root CA of the organization that is evaluating the presented certificate.


The authority information access is an X.509 extension that describes where the relying party can go to download the authority certificate. This is described in detail in RFC 5280. You can also find information on the structure of the Authority Key Identifier.

Cross-signing is when another CA issues a signature against a certificate which has already been signed by another CA. Here is an example:

I work for organisation A and have my certificate signed by the issuing CA of PKI A. My trust Anchor is the Root CA of PKI A. I have a problem, because I want to authenticate to our partner, organisation B, but all their certificates are issued from PKI B. I can get the root CA of PKI B to issue a cross-signature against the root certificate of PKI A. Now the logical chain ends with the root CA of PKI B: I.E. Subject Cert -> Sub CA (A) -> Root CA (A) -> Root CA (B).

Cross-signing is not actually implemented inside the certificates. I have to use the LDAP directory entries to implement cross-signing, which is why AIAs and AIDs are so important to cross-signing.

The LDAP directory standard schema entries for PKI are defined in RFC4523. These include the entry for a PKI CA. This entry, in turn, includes the crossCertificatePair attribute. This contains the pair of certificates that are issued by the cross-signing CA. In the above example the entry for root CA (A) would contain the cross-signed certificate for root CA (A) and the certificate of root CA (B).

Section 6 of RFC 5280 includes the algorithm for carrying out certificate path validation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.