3 ms·
What would being an "Intermediate CA" actually mean in practise? Am I right in thinking I could generate my own certificates for any domain I wanted and have t
by BuildTheRobots 10y ago
What would being an "Intermediate CA" actually mean in practise?
Am I right in thinking I could generate my own certificates for any domain I wanted and have them validate in any browsers or devices that currently trust StartSSL/WoSign? Or to put it another way, would it give me the same powers as running my own internal CA but without the problem of convincing people to install my root-ca?
I assume it _can't_ mean that, otherwise people would surely be up in arms (10k to mitm anyone is scarily cheap), so could someone educate me please?
- mcpherrinm 10y agoI'm not sure about this specifics here, but this is a feature offered by some CAs: They create a new intermediate, signed by their root, just for you. You then get to ask that CA to issue certs for you - and only you. You don't have total control over the intermediate -- as you suggest, that would let you mitm everyone. But by having an intermediate that you effectively control, you could have apps/devices/etc that trust only that intermediate (via pinning, HPKP, etc). That prevents a bunch of the possible downsides of using the public PKI (eg, a CA mis-issuing a cert for your domains), the downsides of pinning a leaf cert (because you can always issue another one off your intermediate if you change names, etc), and the downsides of a private PKI (because stuff that trusts the public PKI works too)