4
One type of attack that TLS/PKI seem to focus on and claim to counter is the man-in-the-middle attack. Assuming an adversary has the ability to send/receive packets to/from an address that is not his (the whole point of using TLS/PKI in the first place), this adversary can easily "prove" to a trusted CA that he controls a domain that he does not ...
2
Whether or not a certificate can be used to sign another certificate is defined by the basic constraints field of the certificate. When you submit a CSR to a CA, the certificate returned by the CA should specify that the certificate cannot be used to sign other certificates in the basic constraints field.
Otherwise, this would open the door to anyone being ...
2
https://tools.ietf.org/html/rfc5280.html#section-4.2.1.3 has this to say:
If the keyUsage extension is present, then the subject public key
MUST NOT be used to verify signatures on certificates or CRLs unless
the corresponding keyCertSign or cRLSign bit is set. If the subject
public key is only to be used for verifying signatures on
certificates and/or ...
1
By 'Client Certificate' do you mean in SSL/TLS and (thus) HTTPS? If so, 8446 (for TLS1.3) references 5280 for cert validation, although earlier versions were not explicit, and libraries generally implement this (or at least its predecessors; in OpenSSL for example the cert validation code didn't change much from about 2000 to about 2015). Typically a server ...
1
Do I need to install the certificate of every subCA as Trusted Root Certification Authorities?
no, only root CA certificate is installed to Trusted Root CAs store. Intermediate CA certificates go to Intermediate CAs store.
Is there another way to implement the certificate chain into the certificate for CUPS1.local, such that I only need to install the ...
1
Anyway, out of curiosity I would like to understand if windows can also somehow read the chain?
There is no "somehow read the chain". Either it has the necessary chain certificates or it does not. It can have the certificates if they are provided up-front (i.e. installed locally) or if they are provided during verification. The latter is the ...
Only top voted, non community-wiki answers of a minimum length are eligible
