15

Is it possible to sign a new certificate using a certificate signed by a CA as the CA for other certificates and still have them validated by the root CA?

Example:

# create new key
openssl genrsa -des3 -out server.key 2048
openssl req -new -key server.key -out server.csr
....
# send csr to ca for signing
....
# now what if we make a new key and sign it with the received crt?
openssl genrsa -des3 -out newkey.key 2048
openssl req -new -key newkey.key -out newkey.csr
openssl x509 -req -in newkey.csr -CA server.crt -CAkey server.key -CAcreateserial -out newcert.crt -days 500

Why is it not possible to do this? I tried using this new cert for a service and the browser complains that the certificate lacks CA chain. Basically I want to use one certificate that is signed for the domain and create new certificates for subdomains using domain certificate as CA for the subdomains. How is this process designed to work?

1
  • This question appears to be off-topic because it is about PKI and not about programming. Jan 24, 2014 at 7:56

2 Answers 2

22

Whether or not a certificate can be used to sign another certificate is defined by the basic constraints field of the certificate. When you submit a CSR to a CA, the certificate returned by the CA should specify that the certificate cannot be used to sign other certificates in the basic constraints field.

Otherwise, this would open the door to anyone being able to create a fake certificate for any site. For example, I could create a CSR for mysite.com, get the certificate signed by a CA like VeriSign, then create a CSR for www.paypal.com and use the certificate for mysite.com to sign the certificate for www.paypal.com. Then, I would have a valid certificate for www.paypal.com. But, I'm not paypal.com.

Notwithstanding, many early SSL implementations in early browsers and even some early versions of OpenSSL did not check the basic constraints field of the certificates in a certificate chain, so this was a vulnerability that could be exploited. Security researcher Moxie Marlenspike was active in bringing this to the public's attention which forced browser makers to fix this. See http://www.thoughtcrime.org/ie-ssl-chain.txt for more info.

3
  • you will not be able to sign the certificate of paypal.com, since you can only sign it with our own private key. to make it signed also by veriSign, you'll need also the private key from the CA, which you don't have, only a certificate signed by the CA
    – benez
    Oct 23, 2017 at 12:36
  • @TypeIA if his mysite.com certificate signed by VeriSign does allow him to sign other certificates via basic constraints, does that mean he can sign paypal.com with his mysite.com certifcate and private key and everyone trusting VeriSign will also trust this paypal.com signed by mysite.com? that would at least explain why this trust chain is always so short...
    – benez
    Mar 12, 2018 at 16:22
  • 2
    @benez Yes, if VeriSign signed his mysite.com cert with basicConstraints = CA:TRUE, he could then sign anything with his mysite.com cert and the resulting signed cert will have a valid trust chain reaching back to VeriSign. The mysite.com cert is then acting as an intermediate certificate. Intermediate CA certificates are used all the time, but no one will issue one to a consumer for obvious reasons.
    – TypeIA
    Mar 12, 2018 at 18:31
5

Why is it not possible to do this?

mti2935 had a good answer. To summarize, it breaks the trust model under most circumstances.


I tried using this new cert for a service and the browser complains that the certificate lacks CA chain.

Install the signing certificate in the "Trusted Certificate" store.


Basically I want to use one certificate that is signed for the domain and create new certificates for subdomains using domain certificate as CA for the subdomains.

Will there be a unique certificate for each subdomain, or will there be one certificate with all subdomains list in the Subject Alternate Name?

The former is doable - you just buy a new certificate for each subdomain. The later is a little more difficult, but not impossible.

To do the latter, you typically use an subordinate root or intermediate that allows you to mint end-entity certificates as you need them. If you are running your own private PKI, then you can do it. In the private PKI case, you tell your users to install your trust anchor (or "CA root") in their "Trusted Certificate" store.

If you want to avoid browser warnings and the like without requiring a user to install your trusted root, then you need to get it touch with folks like Trustwave. They have sold these types of certificates in the past. More correctly, they put the private key in hardware so the appliance could be sold for a higher price and the private key could not be copied. See, for example, Trustwave admits issuing man-in-the-middle digital certificate.


How is this process designed to work?

It depends on the use case. PKI is PKI and any introductory book will lay out the concepts. But a private PKI has a different model than the browsers because they are different use cases.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.