Is it possible to sign a new certificate using a certificate signed by a CA as the CA for other certificates and still have them validated by the root CA?
Example:
# create new key
openssl genrsa -des3 -out server.key 2048
openssl req -new -key server.key -out server.csr
....
# send csr to ca for signing
....
# now what if we make a new key and sign it with the received crt?
openssl genrsa -des3 -out newkey.key 2048
openssl req -new -key newkey.key -out newkey.csr
openssl x509 -req -in newkey.csr -CA server.crt -CAkey server.key -CAcreateserial -out newcert.crt -days 500
Why is it not possible to do this? I tried using this new cert for a service and the browser complains that the certificate lacks CA chain. Basically I want to use one certificate that is signed for the domain and create new certificates for subdomains using domain certificate as CA for the subdomains. How is this process designed to work?