1

My organization is preparing to purchase some 50 "units" from Symantec, with which we can purchase Verisign SSL certificates of varying authentication levels. Our organization does not have--but definitely would like--the ability to send digitally signed e-mail to external business partners and clients, and use the same certificate to encrypt e-mail among other members of the organization.

My question is this: Suppose we were to purchase one SSL certificate from Verisign--this certificate would be an intermediate of the root CA. But our organization could then use this for a Global PKI mail server (Say, SecureMail.OurCompany.com) for the purpose of issuing end user (leaf) certificates.

Is this possible (does it even make sense)? Could we use the Verisign-issued certificate to then issue end user (leaf) certificates to incorporate into the company e-mail (MS Exchange) system? How would this be done? What software would one use to do issue end-user certificates this way?

  • I believe you have the right logic. Once you have an SSL cert from Verisign you can then sign certificates within your organization and use them through email. Certificate management would be the biggest problem, I'm sure if you google for PKI Software Solutions you'll get a number of results. I believe Verisign/Symantec offers some sort of management option. – RoraΖ Aug 11 '14 at 18:14
  • @raz, sorry, your comment is not correct, see answers below. – Larry K Aug 12 '14 at 9:52
  • dupe security.stackexchange.com/questions/20513/using-a-verified-certificate-to-sign-others and security.stackexchange.com/questions/33649/man-in-the-middle-scenario-for-tls – dave_thompson_085 Aug 12 '14 at 10:11
2

You don't issue certificates with an SSL certificate -- you issue certificates with an intermediate CA certificate. That's a different beast; namely, contrary to what is colloquially known as "an SSL certificate", an intermediate CA certificate is granted CA power by virtue of including a Basic Constraints extension with the cA flag set to TRUE. Presence of that flag is checked by software which validates certificates. You could, technically, sign certificates with your SSL private keys, but nobody would accept these certificates as valid.

Verisign or any other commercial CA will sell you an intermediate CA certificate only under some rather strict conditions: it will cost you a lot of money, and you will have to demonstrate that you can be entrusted with the power to issue certificates. Indeed, once you have that intermediate CA certificate, nothing technically prevents you from then forging fake certificates for google.com or microsoft.com that would be accepted silently by all Web browsers worldwide. Therefore, Verisign will want to ensure that you have procedures to avoid such shenanigans; in particular, strong physical security for the private key storage, dual control for all administrative operations, insurances, strict revocation procedures, and so on.

While you have the right logic (indeed, it is just a matter of having some "certificate issuing software", which can be as simple as some OpenSSL scripts), you underestimate the costs. If you want to operate your own CA (that's what you are actually talking about), then you will need to do it "properly", that is, with means which are proportionate to the required level of security and quality assurance. You will need to hire a PKI specialist. The cost will far exceed that of buying 50 end-entity certificates every year.

  • Thank you for this bit of field-wisdom. I had a theoretical understanding of how the technology works, but in business practice (and technical implementation), I wasn't sure how feasible such an arrangement would be. It makes sense now that Symantec offers Verisign "Digital ID's" for end user identity/secure e-mail. – Daniel Aug 11 '14 at 18:41
0

Yes, this would be possible if any CA would sell you such an intermediate CA. But no, they (hopefully) will not do it.

The problem is, that the current SSL PKI does not support restrictions for intermediate CAs. This means, once you own such intermediate CA you would be able to issue any certificates you want. This would be certificates for your own infrastructure, but also certificates for google.com or your could even create another intermediate CA below your own CA, which has the same rights.

Because of these problems CAs officially don't sell you such intermediate CAs.

  • Some commercial CA do sell intermediate CA certificates (I once made such a deal with GlobalSign), but only through a heavy contractual agreement with constraints (e.g. they require that you store the private key in a HSM), and the price is non-negligible. – Tom Leek Aug 11 '14 at 18:38
  • I thought this stopped at least officially, see statement from Trustwave from 2012. But I'm sure special agencies will still be able to buy such certificates. – Steffen Ullrich Aug 11 '14 at 18:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.