Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

If nothing else, you should be able to tell the intermediate CA to pretend that a root and then re-sign its public key with your actual root, and then hand the actual root to clients, and hand the new intermediate CA cert to servers to use in the chain. I'm pretty sure the signing process only depends on the public key, not on the entire cert.

This is how cross-signatures work: new CAs will get their intermediate keys cross-signed by existing CAs, so that you can construct a valid chain from them. This creates a different CA certificate, but it's using the same public key, so the end-entity certs validate with either CA certificate.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: