How many different certificates can a subordinate certification authority manage?

Please, supply me also some reference.



A sub-CA can manage (in theory) infinite sub CAs, and they too can have infinite sub-CAs

There is a way for any parent CA to limit this proliferation, the way to do this is to set the path parameter. This counts how many sub-CAs are available and permitted.

For example, if you create a CA that only issues end user certificates, and never another CA certificate, then the parent CA (usually the policy CA) should set the Path=0 for that certificate issued to the Policy/sub-CA.

  • BC.pathLen limits depth, not breadth, which appears to be the question. Breadth can be large but not infinite; RFC5280 profiles serialNumber as maximum 20 octets, and best practice (including CABforum) requires significant entropy; at a conservative 40 bits that leaves 2^120 potential certs. But I don't think you could store that many certs (much less other CA data) in this universe. OTOH there is probably no way to use more than maybe 1000 CAs per person in the world, so that's only about 2^43. – dave_thompson_085 Dec 5 '14 at 5:42

No, not with regular PKI
Could your question also be phrased "If I control a Root CA, can I then limit one of my sub CAs to issue a maximum of, say, 1000 certificates?" -- If that is what you're asking, then "No". There is nothing like that.

The root CA is no longer involved with its Sub-CAs after they are created. And it has no way of knowing what the Sub-CA is signing or not signing, or how much.

(If you want to make a business model out of something like that, I imagine, you could buy a development version of a hardware-security-module (HSM) and sort of re-engineer it to quit working after a certain amount of certificates.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.