Greetings! I am software developer, and have a task to create my own CA, supporting CT technology. So, may I use Let's Encrypt services to create my own, not self-signed CA certificate (with Basic Constraints: CA = true, e.t.c.), and later use it for creating precertificates and put this chain in …

No, this is not possible. And from what I've remembered from previous threads about this topic, the Let's Encrypt staff is also not providing such services in the future. You've got to realise that if a CA would issue such a sub-CA, even though the sub-CA would need to be fully audited ($$$!), the …

There are commercial CAs that offer this service. It's expensive, in the high six to low seven figures.

Certificates have a Key Usage field which determines the functions the certificate can be used for. The certificate you get via Let's Encrypt does not have the "Certificate Signing" feature so can't be used to further create a trusted chain.

[image] ifomin: am software developer, and have a task to create my own CA, supporting CT technology. Then create your own CA; I'd look at Small Step CA . [I don't read anywhere that requires your CA to be signed by a trusted CA nor globally trusted]

[image] rg305: I'd look at Small Step CA . ...and if you have a spare Raspberry Pi, here's how to set it up: [image] Build a Tiny Certificate Authority For Your Homelab Let's make a tiny, standalone CA! We'll use a Raspberry Pi 4, YubiKey 5 NFC, and Infinite Noise TRNG. …

[image] rg305: [I don't read anywhere that requires your CA to be signed by a trusted CA nor globally trusted] I read the "not self signed" part as meaning that.

If so, ask whomever assigned the "task" to you to open their checkbook!

Reading the OP I think he need a CA that a CT log server will accept certificate from, try those google CT log server in test section. creating precertificates and put this chain in test CT-log for getting SCT stamp? or maybe LE staff can give a CA certificate that accepted by testflume? …

btw how to request a test CA to be accepted in testflume CT logs? @lestaff

[image] Adding some Dev Roots to Testflume Client dev H… [image] Certificate Transparency (CT) Logs - Let's Encrypt Certificate Transparency (CT)is a system for logging and monitoring the issuance of TLS certificates. CT greatly enhances everyone's abilit…

Can I create my own SubCA certificate?

Issuance Policy

Nummer378 March 25, 2022, 12:42pm 11

Topic		Replies	Views
Letsencrypt & CA Feature Requests	21	3552	May 17, 2020
Can we host our own sub-CA for our domain from the LE Chain? Help	12	4409	November 24, 2018
I need to generate a Full Chain using my own csr Help	5	544	May 2, 2024
Sub certification authority? Server	5	3017	September 14, 2017
Why doesn't Let's Encrypt issue CA certificates? Feature Requests	25	5442	February 7, 2021

Can I create my own SubCA certificate?

Related topics