Imagine we have two companies, A (our) and B, both having some web-services. Company A uses company's B web service and vice versa. All web services are secured with server SSL certificates, and client SSL certificates are used for authentification.
For testing purposes our company (A) issued a self-signed server certificate and a corresponding client one, both signed by our standalone CA, which was added to trusted root CA's on server and clients.
Now we need to go real world and we ordered a server certificate from GoDaddy. How do we get corresponding client certificate? Company B wants a new client certificate, which would be signed with trusted CA, because "it makes sure that private keys remain where they should be".
They sent a CSR, what should I do with it? How do I issue a trusted client certificate using it?
The interesting fact is that Company B uses certificates issued by Company B Standalone CA, but browser shows it as valid (i.e. green), although I didn't add any intermediate CA's to my trusted root authorities. The certification path of such certificate doesn't contain any well-known CA's like Thawte, Verisign, etc. How is that possible?