if we left cross sign cert alone and create a new 90-day certificate in August, than in DST-cert's view it's a leaf certificate that with lifetime extends after CA's expire date. I'm not sure if that's allowed? I look though CA/B BR but cannot find rule that forbid this, but it still makes me worry.
3 Likes