In message <[EMAIL PROTECTED]> on Sat, 18 Oct 2003 16:19:55 -0700 (PDT), Laurent de
Clermont-Tonnerre <[EMAIL PROTECTED]> said:
chandlerdeux> I have read about cross-certification. OpenSSL allow
chandlerdeux> to have 2 CAs signing each other certificate so they
chandlerdeux> trust each other.
chandlerdeux>
chandlerdeux> I want to know first if OpenSSL could allow a
chandlerdeux> certificate to be signed twice ?
No, and that's not how cross-certification works either. What happens
when you cross-certify is that each CA ends up having two certificates
with the same key and the same subject. One of the certificates is
issued by the own CA and signed by it as well, the other one is issued
and signed by the other CA.
Now, depending on the user, they will either have the own CA as a point
of trust (and would therefore use a certificate chain that ends with
the own CA's root certificate) or the other CA (and would therefore
end up with a chain that includes the other CA certificate).
Is that somewhat clear?
chandlerdeux> I trying to have a proxy issue from a certificate to
chandlerdeux> be trusted by two different CA, the one that issue the
chandlerdeux> certificate and anther).
chandlerdeux>
chandlerdeux> But i want this without the two CAs trusting each
chandlerdeux> other : no cross-certification of the 2 CAs and no
chandlerdeux> copy of each other certificate in
chandlerdeux> /etc/grid-security/certificates.
chandlerdeux>
chandlerdeux> But a certificate seems to only accept one issuer, so
chandlerdeux> that might be impossible.
You need to have your certificate request issued and signed by both
CAs, and will end up with two certificates. This will give you two
validation paths.
Note that OpenSSL doesn't handle multiple paths very well, so it will
have some problems verifying some certificates in such a structure.
It's in the plans to extend OpenSSL to become more capable in this
field.
--
Richard Levitte \ Tunnlandsv�gen 3 \ [EMAIL PROTECTED]
[EMAIL PROTECTED] \ S-168 36 BROMMA \ T: +46-8-26 52 47
\ SWEDEN \ or +46-708-26 53 44
Procurator Odiosus Ex Infernis -- [EMAIL PROTECTED]
Member of the OpenSSL development team: http://www.openssl.org/
Unsolicited commercial email is subject to an archival fee of $400.
See <http://www.stacken.kth.se/~levitte/mail/> for more info.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
