0

Many big websites use their own intermediate signing certificates to generate SSL certificates for their domains. The intermediate certificates are issued by the usual root CAs but have a "Certificate Signing" key usage attribute. However I've noticed in some cases that the intermediate certificate is simply granted to "Company Name" and there is no mention of anything related to a domain name. How is the company prevented from signing certificates for any domain name other than its own?

The certificate chain for Microsoft has no mention of domain name anywhere other than the last certificate in the chain.

0

Many big websites use their own intermediate signing certificates to generate SSL certificates for their domains.

No, they usually don't. Only very few have their own CA signed by a root-CA.

How is the company prevented from signing certificates for any domain name other than its own?

It is not, and that's why you usually don't get a CA certificate to sign your own certificates. Or you only get it with a lot of restrictions and lots of money.

1

You have just shown why operating a CA is a position of responsibility, and why manufacturers of operating systems and web browsers limit the list of trusted CAs to around 100 world-wide by default.

When a CA delegates signing to a subordinate CA, the parent CA will typically impose name constraints or other policy constraints on the subordinate CA (for example, a subordinate CA descending from "US DoD CCEB Interoperability Root CA 1" may require the issuing CA to only sign Machine Authentication certificates if the SubjectCN and SubjectAN entries end in ".mil"). The parent CA may also limit by policy the chain length, preventing a subordinate CA from delegating additional subordinate CAs.

Much of this is documented and curated as standards and best practices by the CA/Browser forum. Additionally, Entrust's whitepaper about peer cross-signing of CAs has some interesting and accessible information about policy constraints.

Hope that helps.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.