> I have a question about creating intermediate certificates with limited > CN's that they can sign for. If I have my own fully-trusted root > certificate, can I create a limited intermediate CA certificate for a > particular subdomain that can sign certificates only for subdomains of that > domain? > For example, can I create a '*.youwant.to' CA cert that can sign > certificates for things like 'www.youwant.to' and 'ftp.youwant.to'? (But not > 'www.gate.net' of course.) I would then give that intermediate cert to the > owners of the domain 'youwant.to'.
A certificate is a kind of signed digital document, and there is nothing that prevents any certificate and RSA private key from signing and issuing any certificate. There might be some X509v3 extension (or you can easily create one) that you can put in a parent certificate, that can specify restrictions the child certs signed by the parent. However, I doubt that most of the standard clients (like Netscape/Mozilla, Microsoft IE/Outlook, etc.) would be able to handle that type of X509v3 extension for restrictions in a certificate chain. But if the certs are only intended for a closed client application that is based on OpenSSL, then that application can be modified to use that extension to restrict client certs in the manner that you want. Alicia. ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
