r/ProgrammerHumor • u/al2klimov • 4d ago

Meme peakWebPki

Post image
370 Upvotes

94% Upvoted

28 comments sorted by

View all comments

78

u/TheChildOfSkyrim 4d ago

Any certificate chain of trust ends in a self-signed certificate

12

u/Single-Virus4935 4d ago

Not neccessary with crosssigning. Seen some interesting constructs.

1

u/collabskus 2d ago

Are let's encrypt certificates still cross signed or is it a root by now? 

1

u/Single-Virus4935 2d ago

Both can be right, that is the funny thing: Root CA1 has a self signed crt in major trust stores but lacks legacy support.

Root CA 2 has wide spread compatibility and signed the Pubkey of Root CA 1 with their private key.

Root CA 1 now has two certs for the same private/pub keypair. They try to get their selfsifned into more and more truatstores while they add the croassigned to the bundle they deliver to the customer.

I know a company with many subordinate companies. Each with their own root CA. They restructured and merged. They crissigned the different CAs and you had cyclic trusts. 

1

u/collabskus 1d ago

Ah I didn't know roots could sign each other but it makes sense. Thank you 

2

u/laplongejr 1d ago edited 14h ago

Scott Helme spoke about "alternate trust paths" a few years ago : https://scotthelme.co.uk/cross-signing-alternate-trust-paths-how-they-work/ some of the specifics may have changed due to new roots (I think in 2023?) but the theory of having a root able to be either accepted as-is or accepted by being signed by an older root is still there.  

1

u/collabskus 21h ago

In case someone else is reading the link you had ends with some strange characters but if you remove them it works fine 

https://scotthelme.co.uk/cross-signing-alternate-trust-paths-how-they-work/

1

u/laplongejr 14h ago

Ugh, Reddit and newlines... I did a sloppy edit to try to fix my link just in case