Pin Sub CAs while issuing the certificates

[Osiris]

Not sure that was the point, as Rudy clearly says sending both.. I'll leave it at this..

[rg305]

I prefer to teach a man to fish over just handing out fish.
The "spark" was to lead them think/test/learn/solve.

If the unit does require the intermediate cert, then that is a problem.
But... if it can be fed both intermediates, then either cert path would work.

[Osiris]

@rg305

But... if it can be fed both intermediates, then either cert path would work.

How? Because the certificate is ultimately signed by just one of them. Sending a useless intermediate too doesn't make the fact that the server is trusting the incorrect certs go away. If a good intermediate in the chain doesn't work, why would sending an incorrect intermediate too matter at all?

[rg305]

@rg305

If the unit does require the intermediate cert, then that is a problem.
But... if it can be fed both intermediates, then either cert path would work.

That is not done from the server.
It gets done however the device allows:

@ashuec90

Our device configuration is automated and is done while plugging the device. If the chain is updated then we have to reconfigure the device again

My thought-provoking comment was to do just that provoke thought; Which might lead to testing which could lead to learning and ultimately lead to solving the problem.

[Bruce5051]

@ashuec90

we have to ask other teams to put that intermediate certificates in their devices also.

@ashuec90 maybe I am missing something, but why not just the Trusted Root Anchor Certificates?

[rg305]

@ashuec90

we have to ask other teams to put that intermediate certificates in their devices also.

@ashuec90

Our device configuration is automated and is done while plugging the device. If the chain is updated then we have to reconfigure the device again.

@ashuec90

Thats how it is configured in the devices, and we cant do much here, the setup was like that only from starting,so we wanted some workaround to tackle this situation as we are blocked and cannot move forward.

@ashuec90

please suggest some way, using which we can pin the CA to R11.

Try pinning both.

[Bruce5051]

@ashuec90

Thats how it is configured in the devices, and we cant do much here, the setup was like that only from starting

If “the device” doesn’t need a publicity trusted CA, consider setting up a dedicated private CA by your organization. Then you have total control and ease the reconfiguring of devices as you know all the pieces and make them deterministic.