4 ms·
Unfortunately X 509 doesn't support multiple signatures. But your model is very similar to HPKP, just the details on what exactly is signed are different.
by hdhzy 9y ago
Unfortunately X 509 doesn't support multiple signatures. But your model is very similar to HPKP, just the details on what exactly is signed are different.
- daurnimator 9y agoThanks: that was the piece of the puzzle I was missing. I was confused by how people describe cross-signing as an intermediate cert being signed by two CAs. On further research, it's done via having two intermediate certs. But effectively: they accomplish cross-signing by having two different roots for the same leaf cert: we should be able to do that with 1 CA root, and 1 site-admin root (specified via some HPKP-like mechanism) On the other hand, perhaps the limitation of one cert should be removed somehow? e.g. via an extension: old user-agents would just see the first signing cert, but others would see all of them?