3 ms·
My guess is it that, with this service, GlobalSign will create a sub-CA, but retain full control of it (i.e., own the key), issuing all the certificate themselv
by ivanr 14y ago
My guess is it that, with this service, GlobalSign will create a sub-CA, but retain full control of it (i.e., own the key), issuing all the certificate themselves. Because of that they will be able to ensure that the customer owns all the hostnames.
- tptacek 14y agoThe data sheet says that the product allows in-house CA's to issue certificates "completely independently" of GlobalSign.
- ivanr 14y agoSure. Once they verify one or more root domain names, the customer can have control over their domain space (subdomains). EDIT: The control is enforced by having the customer issue the certificates via a GlobalSign-owned portal. (Disclaimer: I don't have any inside knowledge of what they actually do, but I believe this to be a reasonable assumption.) If someone wants to be fully independent, the only way is to accept to be treated as a CA in their own right (and undergo all audits, etc).
- tptacek 14y agoHow would a product allow an in-house CA to issue certificates for subdomains completely independently of GlobalSign without providing a CA=YES certificate?