On 5/28/2012 5:19 PM, Brian Powell wrote:
Hello,
Last year we deployed a root and intermediary CA's to support a web
service - We have now found some issues with the root CA and need to
fix them.
We have many clients in many organisations which have installed the
old root cert - There is currently one service being verified by this
root.
Is it possible to reissue the root and intermediate CA and have
clients with both old and new root certificates installed work?
More info about our setup.
~~~~~~~~~~~~~~~~
RootCA - 2 Problems:
(Missing Key Usage Directive, AKI contains keyid, issuer ID, and Serial)
Intermediate CA - Problems (MD5 signed)
Final CA - Used to verify various
I saw a recipe to reissue a root CA on this list -
http://marc.info/?l=openssl-users&m=113292902213919&w=2
<http://marc.info/?l=openssl-users&m=113292902213919&w=2>
Now I'm going to test the following with our dev CA....
1) Recreate root cert adding Key Usage directive and fixing AKI to
have keyid only.
2) Create a new intermediate cert
I recently did the same with our internal CA, because it turned
out that recent MS products puke if the AKI and modern CRL URL
extension (X509v3 rather than classic Netscape) are not present
or do not meet strict PKIX requirements (such as not using https
for the CRL download).
I managed to do this by reissuing the root certificate with
exactly the same distinguished name, SANs (there were none),
key and serial number, but different extensions, different
expiry date and thus different bits in the signature blob.
All the existing certificates remained valid, and I only
had to reissue those where the application needed the new
extensions in the end cert too.
Enjoy
Jakob
--
Jakob Bohm, CIO, Partner, WiseMo A/S. http://www.wisemo.com
Transformervej 29, 2730 Herlev, Denmark. Direct +45 31 13 16 10
This public discussion message is non-binding and may contain errors.
WiseMo - Remote Service Management for PCs, Phones and Embedded
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [email protected]
Automated List Manager [email protected]
