Hey, how does LE cross signed his Intermediate Certificate? Can you provide a Documentation how to Cross Sign a (Intermediate/ Root) Certificate/ CA? I have tried to create a Test PKI/ CA but how can i Cross Sign my Intermediate/ Root Certificate Nr. 1 with the Root CA Nr. 2?

You can see the two intermediates “Let’s Encrypt Authority X3 (IdenTrust cross-signed)” and “Let’s Encrypt Authority X3 (Signed by ISRG Root X1)” there: Chain of Trust - Let's Encrypt - Free SSL/TLS Certificates Root Certificates Our roots are kept safely offline. We issue end-entity ce…

It’s for Testing purposes only. But how do i Sign the CSR with “Root Certificate Nr. 1” and “Root Certificate Nr. 2”?

Most people would probably do this using openssl ca (unfortunately I don’t remember the exact command-line arguments; it can be a slightly complex process). https://linux.die.net/man/1/ca Edit: you might need to use openssl req to make a CSR first. You might also need to create some CA-related con…

If you want to run your own CA with OpenSSL manually, here is a very good guide I’ve also used successfully: https://jamielinux.com/docs/openssl-certificate-authority/ Cross-signing is just signing an intermediate CSR with another root certificate.

[image] tdelmas: @schoen regarding ECDSA Root and Intermediates could Let’s Encrypt document how they do it (preferably before doing it) ? All of the relevant keys are generated and stored only in hardware security modules, not on ordinary server machines, and so I'm doubtful that the instru…

[image] schoen: Maybe when @jsha is available he could comment on what information about past or future key ceremonies can be made public. Thank you. Even if it's not useful for ordinary people, I think it's important that Let's Encrypt share as much information as possible: Let's Encrypt i…

Bear in mind that Let’s Encrypt also has a reasonable responsibility to keep confidential security information confidential. If another organization wants to replicate their work, I would hope that they’d have the requisite knowledge and aptitude to do it correctly themselves, not rely on an incompl…

[image] jared.m: Let’s Encrypt also has a reasonable responsibility to keep confidential security information confidential If course, security is important (that's why we use certificates!) but Security through obscurity doesn't seams to be in the Let's Encrypt principles ( About Let's Encr…

I agree with these points. ICANN publishes all of the materials used for the DNSSEC root signing process ( https://www.iana.org/dnssec/ceremonies/32 ), I would assume ISRG/Let’s Encrypt has similar procedures and materials stored somewhere. I think if Let’s Encrypt made these public, it would greatly…

LE Cross Signed Intermediate Certificate

Issuance Tech

tdelmas August 5, 2018, 7:34am 5

@schoen regarding ECDSA Root and Intermediates could Let’s Encrypt document how they do it (preferably before doing it) ?

Topic		Replies	Views
Questions for Crosssigning of Letsencrypt and IdenTrust Issuance Tech	5	2554	May 31, 2017
How to cross-sign with let's encript intermediate authorities with other authorities Issuance Tech	10	1677	June 25, 2023
Cross-signing with CAcert ISRG/Organizational	6	3360	March 24, 2016
Problem with openssl and verify CAfile Server	14	14267	December 7, 2015
Cross-signing followup Issuance Tech	9	3143	November 19, 2016

LE Cross Signed Intermediate Certificate

Related topics