4 ms·
Wouldn't it be nice if you could have certs signed by multiple CAs, so detrusting bad CAs would be easier without wrecking as much stuff?
by wnoise 7y ago
Wouldn't it be nice if you could have certs signed by multiple CAs, so detrusting bad CAs would be easier without wrecking as much stuff?
- emilecantin 7y agoThere's nothing keeping you from getting multiple certs, signed by different CAs, and switching as soon as there's an issue with one of them. Of course, you'd have to do the switching manually.
- drdaeman 7y agoTLSv1.3 removed the requirement on the certificate ordering. I haven't tried but I believe you can supply multiple certificates (and chains) in there.
- tialaramex 7y agoThe constraint loosening says your Leaf must be first. If you obtain different leaf certificates from different CAs then you can't "put the leaf first" for all of them. In today's browsers the first leaf will be treated as your apparent leaf (so the Subject needs to match the hostname in the URL), other leaves presented will either be discarded or cause an error. So no benefit.
- lmm 7y agoYou wouldn't need multiple leaves though? You generate your own certificate and send the CSR to the CA, no?
- tialaramex 7y agoYou've definitely misunderstood something here, I'm going to guess and explain the bit I think you have wrong, but if I guessed wrong and that's not the bit you were unclear on we can try again. So, a Certificate Signing Request is a request that a CA signs some certificate but especially in the Web PKI it's an error to think of it as a request to sign one particular certificate. The result of sending CSRs to two or more CAs is not two otherwise identical documents with different signatures. Experts talk about "signing a CSR" knowing that's not exactly what they mean even though in a toy CA built out of OpenSSL it seems like that works. In reality a properly created CSR is proof that you know some private key (not revealed to the CA) corresponding to a public key (which is) and you want a certificate for some names. But the Certificate Authority will need to at least choose their own random serial number, fill out their own Issuer name and key, and choose appropriate date-time values for the certificate's lifespan (notBefore / notAfter). In reality they often at least partially discard the names you filled out because their rules may forbid issuing certain names you've asked for. If you use automation like Certbot the names requested exactly match what you wanted, but if you're building CSRs with OpenSSL or some 1990s Java web forms on an appliance chances are the names in the CSR are semi-bogus and issuing for them is forbidden so the CA needs to figure out what you actually needed. Anyway, as a result for each CA you'd get a distinct Leaf certificate which (if you follow the DAG backwards) gets to a different trusted root. But you are only permitted to send one Leaf in TLS despite the otherwise relaxed constraints.
- wnoise 7y agoHow much of this is fixable with generating the right CSR and choosing the right CAs? Does "will need to at least choose their own random serial number, fill out their own Issuer name and key" absolutely wreck it?
- bluesign 7y agoActually better can be like nested signing with many CAs, I sign my certificate with 3 different CA, let's say from US, Russia, China etc. Unless all 3 are bad, I am safe.