How to chain a SSL certificate

Question

Is there any way we can chain our own generated key pair with an existing certificate which has been chained to a root CA (eg: verisign)? Basically my question is described in diagram below

Verisign Root CA
     |
     --> Company XYZ certificate
                     |
                     ---> Server foo certificate

Once i've generated key pair for server foo, how do I chain it with Company XYZ cert?

Solution 1

If Company XYZ has an Intermediate Certificate Authority certificate then you can. This kind of certificates are authorized by the root CA to issue new certificates and this fact is determined at creation time by specific properties (Basic Constraints, Key Usage, Enhanced Key Usage).

But if Company XYZ has a regular certificate, used for example to identify websites, email users or software developers, it is not possible. Even thought in practice nothing stops you from creating a new certificate and signing it with another one (if you have it's private key), I don't think that you will obtain a valid certificate.

So, if you have the right kind of certificate, you will have to sign foo with it. You can use makecert or open ssl for creating a new X509 Certificate. For example:

makecert -pe -n "CN=foo" -a sha1 -sky exchange -eku 1.3.6.1.5.5.7.3.1 -in "Company XYZ" -is my -ir LocalMachine -sp "Microsoft RSA SChannel Cryptographic Provider" -sy 12 -ss my -sr LocalMachine

You will need to have the certificate for the Company XYZ installed in the Local Computer/Personal location in Windows Certificate Store. The resulting certificate will be added in the same place and you will be able to export it from there in various formats (.pfx, .cer, .p7b). Also this creates the keypair for the new certificate.

Solution 2

If you have both certificates, try concatenating the certificate files. If not, please revise your question so we know where you are in the process.

If you're setting it up on an Apache server, look at mod_ssl's SSLCertificateChainFile directive.

Comments

[Michael Mullany]

No you can't do this. Verisign and other root CA's don't issue certs to the general public that can create other certs - this would break the whole point of root cert trust.

[dajames]

There's no technical reason why a commercial CA shouldn't sign the root certificate of, say, an enterprise CA so that the enterprise could issue its own certificates. Such a certificate would need to have the correct usage attributes for key signing. The enterprise's certificates would be trusted because its CA certificate was signed by the commercial CA. That's exactly how the PKI chain of trust is supposed to work. There are, however, commercial reasons why this is seldom done (lots of identity certs make more money than one key-signing cert).