This question already has an answer here:

I've a task to create Certificate Authority for company use. Preferably using "valid" ( not self-signed) certificate. The goal is to issue individual certificates for subdomains, instead of wildcard, plus sub-subdomains, not covered by wildcard cert, users, services, etc.

All this may be limited to a single domain only.

As I understand I need valid certificate which has certain capabilities in it like this Key Cert Sign, CRL Sign.

Is that true and can someone point me to the documentation and SSL provider who can sell me that kind of certificate ?


UPDATE: Thanks for the comments: I may need to rephrase my question then, what is needed to issue publicly valid certificates for services and users ? There are some sites issuing user certificates, like this https://www.comodo.com/home/email-security/free-email-certificate.php. But I don't want to rely on public and free services for company use and would rather use something constant and reliable.

marked as duplicate by Zoredache, RolandoMySQLDBA, fukawi2, mdpc, Sven Jan 31 '15 at 9:18

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • A certificate authority is an organization that verifies other organizations. You can't just create it. What you're describing is exactly what you don't want, a self-signed certificate. There are only a few CAs that are trusted universally in browsers. – Devon Jan 30 '15 at 18:40
  • 2
    @Devon That's actually not correct. It is a trivial process to create a CA, and it's done very frequently for usage inside organizations. – EEAA Jan 30 '15 at 18:44
  • 1
    @stimur I believe that would defeat the purpose of the trusted CA if you can just sign / distribute your own certificates. – Devon Jan 30 '15 at 19:04
  • 2
    @stimur It's technically possible, yes. Your trick is going to be trying to convince a publicly-trusted CA to grant you a signing certificate. Which they won't do. – EEAA Jan 30 '15 at 19:04
  • 3

First, no public trusted certificate authority is going to grant you any type of signing certificate.

Now that we have that out of the way:

Since this is for internal usage, you don't need any sort of certificate from an outside source - just start your own CA, and distribute its CA cert to all of your clients' trusted certificate database. Then you can request and sign certificates willy nilly and all of your clients will trust them.

  • Thanks, I was considering this variant, although it involves distribution of local root certificate to all endpoint devices. I was thinking that there is a way to get 'intermediate' certificate which can sign my local ones. is that something unusual ? – stimur Jan 30 '15 at 18:49
  • 2
    @stimur You absolutely will not be able to get an intermediate cert signed by a globally trusted CA, unless you're a world power with leverage over them or use hash collision vulnerabilities to create one. Distribute an internal CA to your devices - if they're Windows and on a domain, then the process is largely automatic. – Shane Madden Jan 30 '15 at 19:09
  • to sign my local ones. - There simply is no functionality that limits the scope of what an intermediate can sign for. Any CA can sign a cert with any subject. Since there is no way to limit it, it isn't going to happen. – Zoredache Jan 30 '15 at 19:11

Not the answer you're looking for? Browse other questions tagged or ask your own question.