I'm aware of the multiplicative property of the textbook RSA and how it can be used to get a signature from a CA without having the CA directly signing it.
My question is - can this apply to the real world in modern implementations of RSA?
More specifically - assume I have this CA that will sign every CSR (Certificate Signature Request) I give it except a specific one, a "forbidden" one.
Theoretically, I would like to have this CA sign 2 (or more) "valid" CSRs and "multiply" their signatures to generate the desired "forbidden" signature (that one CSR the CA refused to sign)
Could this work?