alt Hacker NewsIt is a shame that you cannot have a cert signed by multiple CAs.
(The format seems like it would allow it, but nothing supports it, and in practice CAs demand the ability to actually modify some fields, and then sign that.)
Replies
https://en.wikipedia.org/wiki/Convergence_(SSL)
shame it wasn't adopted. rent seeking CAs would never go for it.
Would it really be worth the extra complexity?
Another option: Use ACME together with ARI (RFC 9773). The client checks ARI data every hour. If the cert needs to be replaced – for example like in this scenario – the CA will inform the client, which in turn would then request a new cert.
I know it’s not convenient to automate for every kind of device though. I guess in some of those cases it might be better to have a load balancer in front of the device. Or use an alternative PKI.
Every time there is a CA issue, someone comes up with "this would be so much better if we'd make it more complex than it already is, as it would make it a bit more convenient to deal with the most recent issue".
I don't think that's the right way to think about it.
I think certificates should be like badges that you can collect – the more badges the higher the trust. So if you are a French company, maybe the tax office in France can sign your certificate to show that you indeed is a real company. If you are accepting card payments – Visa and Mastercard could sign your certificate. If you have a domain the TLD owner could sign your certificate to show that it's indeed your domain… And so on…
And then the browser could present these badges in a nice way to the user.
X.509v3 just has one issuer Name in the certificate, unless you're talking about something else?
It is done with intermediate certs, though! It's a common method of establishing trust in new root certs: sign the intermediate with an already-trusted root cert, then wait for the community to adopt the new root cert over the years.
For example, the initial Let's Encrypt Authority X3 was signed by both their own (new, not-yet-universally-trusted) ISRG Root X1, and the universally-trusted third-party IdenTrust DST Root CA X3.
One crucial detail is that it isn't the same certificate. Rather, it is two separate certificates which just so happen to be using the same key pair, so the leaf cert is in essence signed by both intermediate certs at once.
I wonder if it would be possible to do the same thing on your own, actually: can a server present two completely separate cert chains to a connecting client - as long as the leaves use the same key pair? Technically AFAIK the only requirements should be 1) the key pair in use for the connection matches the cert, 2) the domain matches the cert's Subject, and 3) the cert is trusted, so at first glance it might be possible...