4

we have a wildcard certificate (*.ourcompany.com) purchased form digicert. I have been asked to set up a system wherein certain employee's have their own SSL Cert, to be used for signing PDF's, etc.

I have the impression that I can create these and sign them using our certificate, making them valid. however all my searching is finding me "code signing certificates" which is not at all what we are looking to do. I believe we need to make a certificate signing request somehow, with the individuals details, then sign that request, however I am unsure exactly how to do so (especially given all the different files that make up the cert we were given).

Here's what I have received:

|digicert/
|-star_ourcompany_com.csr
|-star_ourcompany_com.key
|-certs/
|--DigiCertCA2.crt
|--star_ourcompany_com.crt
|--TrustedRoot.crt

Can anyone shed any light on the best way to do this?

Improve this question

1 Answer 1

Reset to default
7

You can only sign certificates with that certificate if it has the certificate-signing bit set, which it almost certainly doesn't. You need to set up your own CA with its own root. There are many tools available to help you do that. You can even do it with OpenSSL, if you can remember the dozens of commands and their dozens of sub-commands each.

Improve this answer
5
  • is there a way to check if the certificate has the certificate signing bit set? I only ask because my boss is fairly trig, and I doubt he'd tell me to do something we cannot do.
    – Chris O'Kelly
    Jul 23, 2012 at 3:03
  • List all the certificate attributes with one of the thousands of OpenSSL commands, probably the x509 command.
    – user207421
    Jul 23, 2012 at 3:26
  • OK so I did sudo openssl x509 -text -in certs/star_ourcompany_com.crt and got ` X509v3 Key Usage: critical Digital Signature, Key Encipherment X509v3 Extended Key Usage: TLS Web Server Authentication, TLS Web Client Authentication ` (among some other details which didn't seem pertinent). I am guessing the certificate signing bit would have been in the key usage section somewhere. Would it be somewhere else or, as is seeming more likely to me know, does getting the above response show we cannot do this using this certificate?
    – Chris O'Kelly
    Jul 23, 2012 at 3:44
  • 5
    @ChrisO'Kelly, the extension you should look for is "Basic Constraints". It's very unlikely that your server certificate was issued with something else than CA:false (thereby making it an intermediate CA certificate).
    – Bruno
    Jul 23, 2012 at 8:04
  • Yeah EJP and Bruno, you were both right, I was on a wild goose chase. Thanks
    – Chris O'Kelly
    Jul 23, 2012 at 22:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.