Situation: I have an internal PKI with a shared root CA, and multiple intermediate CAs. I want anything issued by any intermediate CA to all trust each other. Is there a way to do this that most programs/languages will be happy with?
My present understanding is that this isnt easily possible, but I'm wondering if my understanding is flawed.
So if we have programs:
- funky fresh with a trust chain of shared root => first int
- sparkly clean with trust chain of shared root => second int
and I absolutely need mutual trust between these two, is my only choice to make a big CA certificate with root=>first and root=>second stapled onto each other? Or can I somehow just have a chain with root in it?
Could I get by all of this by adding the root to the OS level trust store, or if they're containers, into a given containers trust store? (under
/etc/pki/ca-trust/source/anchors or something)
My second thought, and perhaps this is a bad one, but because everything is internal and we have a CRL -- we can only use a root CA, and simply keep a strict eye and a clean CRL for TLS certificates instead of CA-level certificates.
Is there some way I can hopefully get software to build it's own chain if I expose the CRLs and CAs at specific endpoints defined anywhere?