Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is it possible to have a OpenSSL Certificate signed by multiple CAs?

Background: We have a CA to issue certificates mainly for our machine-to-machine communications. Now we need to make some services accessible to users as well and would like to use the same CA but it is of course not trusted by most vendors. It would be nice if we could get those certificates signed by another CA to increase trust.

share|improve this question

3 Answers 3

It would be nice if we could get those certificates signed by another CA to increase trust.

Even if this was possible it wouldn't increase the level of trust, because an untrusted party also signed the certificate, which means the certificate in general should not be trusted. I suggest you just sign everyhing from a new CA vendor that the major platforms actually trust.

share|improve this answer
1  
So if Alice (who is trusted), says “that is Bob“, so we know that he is Bob. But now Charles (who is not trusted) also says “he is bob”, and now I am not so sure? Is not Charles's testimony invalid? –  richard Sep 20 '12 at 11:52

The only way to increase trust would be to have your CA signed by a trusted CA. That way, your CA would act as an intermediate CA, so that the clients can follow your certificate chain back up to one of the pre-trusted CAs, but your issued certificates all still originate from one common root.

That's the theory at least—but as far as I understand no CA will be willing to do that unless you hand your PKI over to them. The CACert wiki has some details on the problem.

So as it seems, you are stuck with either getting your clients to install a new trusted CA, or having your client-facing certificates issued not by your own CA, but by some of the big, pre-trusted ones as Ramhound suggested.

share|improve this answer

No, it's not possible for an X.509 certificate (the type used by OpenSSL) to have more than one signature. However, you can issue multiple certificates that will do the same job.

Provided you keep the key and subject the same, you can create multiple CA certificates that will each satisfy as a valid issuer certificate for the certificates that (those?) CA(s) issue. These CA certificates may themselves be self-signed, or issued by different CA as what's called a cross-signed certificate.

The other answerers are correct: any commercial CA will want to very thoroughly examine your policies and procedures before cross-signing your CA. That said, it's definitely possible from a technical standpoint.

If the users you're talking about are using only devices you control (i.e. they're internal users), then I suggest installing your root CA certificate on those devices. This is what many large companies do (and I actually do it on my own network!) and allows you to issue internal-use-only certificates as much as you like, in accordance with your own policies.

If, on the other hand, the users are external to your organisation (or even employees working from home, for example) then it's probably best to have certificates issued from a trusted, commercial CA. If you'll be needing a lot of these certificates (5+ per year), most commercial CAs have programs that ease the administrative burden and often decrease cost; if you'll be needing a truly large quantity (I'd not even bother looking unless it's more than 100 per year), you can consider approaching a CA to setup a custom subordinate CA (but as above, they'll likely want you to setup a new CA according to their policies rather than cross-sign your existing one).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.