3 ms·
Don’t they tend to cross sign with the old ca cert of a long time due to this?
by lokar 4y ago
Don’t they tend to cross sign with the old ca cert of a long time due to this?
- tialaramex 4y agoYes, you can do this, particularly it can make sense for a long-lived CA to have root #1 sign a certificate for root #2 as-if it was an intermediate, so then you can bring root #2 into use but older clients can trust it by sending them that intermediate certificate, while newer clients should rely on their direct trust. Some older clients unfortunately can get into a state where they distrust root #1 (e.g. because it is old) but they know it exists, and so even though they trust root #2 they can see this alternate path via the intermediate to root #1 and reject the whole mess. People shouldn't write software which does this, but they did.