2 ms·
An example: 1. Webserver requests cert for xyz.com. 1.1. Generates private key 1.2. Generates csr 1.2. Sends csr to ICA. 2. ICA requests cert for xy
by peterwwillis 9y ago
An example:
1. Webserver requests cert for xyz.com.
1.1. Generates private key
1.2. Generates csr
1.2. Sends csr to ICA.
2. ICA requests cert for xyz.com.
2.1. ICA generates private key
2.2. Signs Webserver's csr with private key
2.3. Sends signed csr to CA
3. CA issues certificate
3.1. CA looks up CCA record for xyz.com
3.1.1. CCA contains ICA's key fingerprint
3.2. CA verifies signature of Webserver's csr with ICA's key fingerprint
3.3. CA verifies Webserver controls domain xyz.com.
3.4. CA issues cert
At no time could a bad actor simply compromise the webserver and issue a new cert for xyz.com, because it would need the ICA to approve it (and that could require user intervention). Thus, network access alone would not be enough to generate certs. Maybe this is the extension they're making?