0

I an thinking about this issue and it is hard to estimate technical impacts.

For any relevant reasons, one want to modify one the x509 field of an intermediate CA. This intermediate CA was signed by root CA, and it has already issued some end certificates.

I want Root CA to sign again this intermediate certificate because one field as changed (even a useless field), so the certificate produced a new hash, and so a new signature is made by the root. Suppose you replace the old one by the new certificate (its new signature), what is happening :

  • Is intermediate certificate still trust ? I guess it is as the signature is valid (even if "fresh" one) and we can verify it with Root certificate.

Also, as the intermediate public key has never changed, the end certificates are still valid, and we can verify it (with intermediate public key).

So obviously, the intermediate certificate content has changed, but we can still use it as it is signed by Root, and its public key is still the same.

I suppose there are impacts I couln't see.

Improve this question

2 Answers 2

Reset to default
1

Signing will be done by the key only, so as long the key is not changed all signatures done by this certificate are still valid. But, when building the trust chain for a certificate it will look at the certificates issuer field and then search for a certificate having this issuer as the subject. Only after it found a certificate (or multiple) having this expected subject it will use them to verify the signature.

This means, that you should be able to change any information in the certificate as long as the public key and the subject stay the same.

Improve this answer
1
  • 1
    Yup. And the "Subject Key Identifier" field in the CA cert should also stay the same. (So that it still has the same content that the signed certificates have in their "Authority Key Identifier" field.)
    – StackzOfZtuff
    Dec 5, 2014 at 6:59
0

So, how does an Intermmediate CA change one field, without having to reissue every single cert?

It does a cross signature with it's old key

(--placeholder -- would love to see a great answer on how cross signing works, or I'lll plainly and clearly ask that)

Improve this answer
2
  • But as I see it, it is NOT needed to reissue any certificates, because even if the intermediate certificate content has changed, it is still trusted and signature can be verified. I suppose that it is not that easy, but I can't see why ? How a "client" can see that a certificate authority content has changed, as the signature is still valid (but different, because of new hash). That's the heart of my question.
    – crypto-learner
    Dec 4, 2014 at 23:38
  • 1
    YEs, nothing to reissue, because they are already trusted
    – makerofthings7
    Dec 4, 2014 at 23:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .