4
No, you can't use your purchased signing certificate to sign other certificates. It is not allowed. Although, you can try, but signature will be untrusted. The ability to sign other certificates is governed by Basic Constratins and Key Usage certificate extensions and values of these extensions in your certificate don't meet criteria. For more details about ...
2
Regarding using of certificate to sign other certificates: The answer of @Crypt32 is correct regarding the structure / contents of a certificate.
Regarding "with legal validity": If you use private PKI, this will not be recognizable by the others outside of your organization. Means, it will not have legal validity for the others. When somebody outside your ...
1
Ordinarily, the validity of period of the certificate is not determined by the requestor, and is not specified in the CSR. The validity period is determined by the CA (most CA's offer various durations according to price). So, you would have to find a CA that has a mechanism in place for what you are trying to do.
See CSR expiry date / validity date for ...
1
The way the question is worded, there is a root. Therefore, you should have dismissed self-signed because there is no root in self-signed. That's the "obviously wrong" option (using the 4-option model of obviously wrong, 2 almost right, and right/more right).
Online CAs include the idea of redundancies and a distributed chain.
Only top voted, non community-wiki answers of a minimum length are eligible
