Our company is being acquired by another company and we are curious on the requirements needed to create a cross-certification / bridge CA solution.

Cross-Certification is issuing a Cross Certification Auth. certificate to the root CA of Fabrikam from Contoso's Issuing CA.

"The effect of this Cross Certification Authority certificate is that the Fabrikam Root CA appears as a subordinate CA of the Contoso Issuing CA when the certificate is presented to a computer at Fabrikam."

Is there a preferred method and why?

  • I think, your understanding of cross-certification and bridge CA is incorrect. – Crypt32 Jul 11 '17 at 17:50
  • Cross certification allows you to issue a Cross Certification Authority certificate from a CA in your organization to a CA in another organization. The advantage of cross certification is that you do not have to reissue any certificates to your organization’s users. – Matt L. Jul 11 '17 at 17:59

You will need simple cross-certification. It is suitable to "friend" two PKIs in a easy and convenient way. Each organization cross-certify other organization and publish cross-certificates within their organization.

  • there is no need in bidirectional AD trust (assuming that CRLs are accessible via HTTP, not LDAP)
  • CRLs from other organization must be accessbile from your network and vice versa.

Simple cross-certification isn't much scalable. In practice, it will work for no more than 3 fully connected peers. In order to establish a complete trust between all parties, the number of all cross-certificates to be issued is calculated as follows: formula. In other words, it is a complete graph topology.

When there are 4 or more participants, a number of total issued cross-certificates increases dramatically. This is where CA bridging helps. The graph is transformed into star topology, where Bridge CA is a center of the topology and it is connected to all participants with single edge. The total number of required cross-certificates is calculated as follows: formula

Each party issue single cross-certificate to Bridge CA and Bridge CA issue back single cross-certificate to each party. When other organization present you their certificate, its chain is looped through Bridge CA cross-certificate and ends up with your own root CA.

  • That makes sense. At a point Bridge CAs are more useful with more organizations since you can spin up a "branch" CA in each organization. Cross-Certification we will just need to make sure we can talk to our CRL/OCSPs and deploy both Root Certificates to both environments, correct? – Matt L. Jul 17 '17 at 16:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.