Home / server / Questions / 1033619
In Process
dross
Asked: 2020-09-13 01:02:01 +0800 CST

RootCA and Trusted RootCA

  • 772

I am planning buy a domain name lets called it foobar.net

Home devices will similarly be added to network called foobar.net

I plan to run a certificate authority to issue certificates to these devices.

Can I get a certificate issued by a Trusted Root Certificate so that all the certificate I issued from my CA have a chain of trust up to a Trusted Root CA

certificate-authority

1 Answers

  1. Can I get a certificate issued by a Trusted Root Certificate so that all the certificate I issued from my CA have a chain of trust up to a Trusted Root CA

    no, you can't. The certificate you get from public CA won't allow you to sign other certificates. This is controlled by a Basic Constraints certificate extension. isCA bit will be set to 0 in your certificate, meaning, it is end entity certificate and it is not allowed to sign other certificates. More details, for example, in my blog post: https://www.pkisolutions.com/basic-constraints-certificate-extension/

    • 1