I have the following issue: we use TLS with client cert verification to identify clients to a service. To this end, we have created our own self-signed certificate authority, which does nothing but sign certificates for these clients and verify their validity. We replicate this setup in our development environment.
The development CA has just expired, so no new certificates can be issued in our development environment. We have quite a bit of time left on the production CA, but I would like to figure out if there is a smooth process for migrating from an expired CA certificate to a new non-expired one without breaking existing certificates.
The naive solution is, generate a new CA cert and replace the old one. However, I believe this will cause existing clients to fail validation.
I've done a bit of googling and reading, and I THINK what I need to do is..
- Create a new CA cert and use that for signing new client certs
- Create some sort of "combo" cert which includes both the new CA cert and old CA cert and use that for validating clients (bridge? chain?)
Point 2 is where I'm failing to find detailed documentation. Additional general questions I have:
- Is it possible to set the "combo" cert up in a way that it can be used for both issuing new certs and validating both new and old certs? Like, is it possible to indicate "this certificate is really 2 certificates, and the new one is the one that should be used for signing new clients?" This is strictly a practical concern - fewer files to keep track of.
- Should I just avoid combining anything at all and just use both CA certs in the trust pool of the validating software? I guess this goes back to the first question..
Sorry about the vague language, I'm purposefully avoiding specific x509 terms because I'm afraid I'll use them incorrectly and confuse the question.