Thank you Richard, I'm working here with 2 self-signed CAs. So with cross certification, each CA will have two certificates ? One signed by itself and one signed by the other one, is that it ? I though cross-certification would be each CA signing the other one's certificate, i was wrong ?
My goal is having one certificate working on both grids without the grid to trust each other. Would a hierarchy where a root CA would sign each of my CA's self-signed certificates do it ? How does the path verification works ? Do i have to check myself ? Laurent Clermont. --- Richard Levitte - VMS Whacker <[EMAIL PROTECTED]> wrote: > In message > <[EMAIL PROTECTED]> > on Sat, 18 Oct 2003 16:19:55 -0700 (PDT), Laurent de > Clermont-Tonnerre <[EMAIL PROTECTED]> said: > > chandlerdeux> I have read about cross-certification. > OpenSSL allow > chandlerdeux> to have 2 CAs signing each other > certificate so they > chandlerdeux> trust each other. > chandlerdeux> > chandlerdeux> I want to know first if OpenSSL could > allow a > chandlerdeux> certificate to be signed twice ? > > No, and that's not how cross-certification works > either. What happens > when you cross-certify is that each CA ends up > having two certificates > with the same key and the same subject. One of the > certificates is > issued by the own CA and signed by it as well, the > other one is issued > and signed by the other CA. > > Now, depending on the user, they will either have > the own CA as a point > of trust (and would therefore use a certificate > chain that ends with > the own CA's root certificate) or the other CA (and > would therefore > end up with a chain that includes the other CA > certificate). > > Is that somewhat clear? > > chandlerdeux> I trying to have a proxy issue from a > certificate to > chandlerdeux> be trusted by two different CA, the > one that issue the > chandlerdeux> certificate and anther). > chandlerdeux> > chandlerdeux> But i want this without the two CAs > trusting each > chandlerdeux> other : no cross-certification of the > 2 CAs and no > chandlerdeux> copy of each other certificate in > chandlerdeux> /etc/grid-security/certificates. > chandlerdeux> > chandlerdeux> But a certificate seems to only accept > one issuer, so > chandlerdeux> that might be impossible. > > You need to have your certificate request issued and > signed by both > CAs, and will end up with two certificates. This > will give you two > validation paths. > > Note that OpenSSL doesn't handle multiple paths very > well, so it will > have some problems verifying some certificates in > such a structure. > It's in the plans to extend OpenSSL to become more > capable in this > field. > > -- > Richard Levitte \ Tunnlandsv�gen 3 \ > [EMAIL PROTECTED] > [EMAIL PROTECTED] \ S-168 36 BROMMA \ T: +46-8-26 > 52 47 > \ SWEDEN \ or > +46-708-26 53 44 > Procurator Odiosus Ex Infernis -- > [EMAIL PROTECTED] > Member of the OpenSSL development team: > http://www.openssl.org/ > > Unsolicited commercial email is subject to an > archival fee of $400. > See <http://www.stacken.kth.se/~levitte/mail/> for > more info. > ______________________________________________________________________ > OpenSSL Project > http://www.openssl.org > User Support Mailing List > [EMAIL PROTECTED] > Automated List Manager [EMAIL PROTECTED] __________________________________ Do you Yahoo!? The New Yahoo! Shopping - with improved product search http://shopping.yahoo.com ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
