1
$\begingroup$

I am currently learning about Certificates in Public Key Infrastructure.

Cross-Certification exists as an alternative because the concept of a single monolithic CA certifying every possible user in the world is quite unlikely. Cross Certification are issued by CA's to create Non hierarchical trust path.

It works on the concept that every root CA has cross certified each other. But how is that even possible?

It is stated that almost every country has it's own root CA (in an abstract way). And there exists a lot of countries in the world, then how can all of them cross certify each other?

For Example, the concept of Cross Certification is explained by showing how the root CA of England cross certifies the root CA of Africa. And then Alice living in England can verify the chain of trust of a Bob living in Africa. Stating, that Technically this would mean that Alice's root CA has obtained a certificate or itself from Bob's root CA and vice versa.

This method seems feasible when the number of CA's are limited (like CA of England and japan). But how could this scale up to a large number of CA's(CA of every country)?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
2
$\begingroup$

In practice Cross Certification is rare, instead, certificate consumers trust multiple CAs. For example, Mozilla includes 154 different trusted CAs by default with their browser.

As to the process of cross-certification, it involves a CA signing other CA's public key. It can be one-way or cross-certified.

Improve this answer
$\endgroup$
4
  • $\begingroup$ So browsers tend to have a large no. of certificates pre-installed. But still, what if it encounters an certificate signed by a CA not known to the browser (as in practice the browser can't store the certificate of every single CA in the world)? Like how does the browser resolve that conflict? $\endgroup$
    – Vasu Deo.S
    Commented Jul 24, 2019 at 19:35
  • $\begingroup$ @Vasu: the browser displays an error; the exact display varies across different browsers and different versions. In practice a CA that wants to be trusted on the web applies to the browser and OS (Windows, Apple) root programs, and a website that wants to be trusted uses such a CA. There can be temporary problems, e.g. when LetsEncrypt started in 2015 they (ISRG) initially weren't trusted anywhere, so they got cross-certified by IdenTrust/DST, but even that wasn't trusted everywhere and there were lots of discussions all over the web including Stack about 'LetsEncrypt cert isn't trusted'. $\endgroup$
    – dave_thompson_085
    Commented Jul 25, 2019 at 2:29
  • $\begingroup$ Also to be clear, although many governments do have CAs, nearly all certificates used on the web are from CAs that are NOT run by governments, and that serve more or less the whole world: Verisign/Thawte/GeoTrust/Symantec/Digicert, GoDaddy, Comodo, LetsEncrypt, formerly StartCom, etc. Government CAs are more of a factor in things like national ID cards, passports, truck monitoring, tax and duty collection, and such. $\endgroup$
    – dave_thompson_085
    Commented Jul 25, 2019 at 2:34
  • $\begingroup$ @dave Thanks for sharing this info. $\endgroup$
    – Vasu Deo.S
    Commented Jul 25, 2019 at 6:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.