Hashicorp vault has an API they call Sign Self-Issued. The use case is for rotating root CAs. A user creates a new root self signed CA and then passes it to this API and what is returned is roughly the same certificate except the Issuer, Authority Key ID, and distribution points have changed.

I'm new to all this but when I look at this new "root CA" it appears to me to be the same as an intermediate certificate. Somewhere there was a mention that "the path length" is not changed but I can't find anything about the path length being embedded into a certificate.

The base question I suppose aside from the one in the subject is if I created an intermediate certificate and treated it as a root CA, would that work? I would tell folks "this is the new cert that you need trust" and base my "intermediate" and host certificates from this "root CA"


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.