News for hackers. Stuff that matters.

A comment on Let's Encrypt Overview. Parent comment

Re:Let's Encrypt Overview by baby on Friday June 12, 2015 @03:19PM (#9707982)
They only sign leaf certs
[ Parent | on HN ]
Re:Let's Encrypt Overview by marcosdumay on Friday June 12, 2015 @04:56PM (#9708486)
No, they don't.

That's one of the several elephants on the room with the CA system. They issue non-leaf certs with a big frequency for people like the GP, with a honest reason to want them.

[ Parent | on HN ]
Re:Let's Encrypt Overview by baby on Friday June 12, 2015 @06:02PM (#9708839)
x509.CreateCertificate is used to creat the certificate (https://golang.org/pkg/crypto/x509/#CreateCertificate)

and is called by the CFSSL library, that has isCA = false as default (https://github.com/cloudflare/cfssl/blob/152152bec641f502651...)

Also it is verified that the CSR doesn't contain that field in Boulder: https://github.com/letsencrypt/boulder/blob/aa71088c440a63e1...

This test is called when you send the CA a CSR: https://github.com/letsencrypt/boulder/blob/08ac100788c7edaf...

I don't know for other CAs, but from that quick look of the code boulder doesn't seem to sign certificates that can sign other certificates.

[ Parent | on HN ]