Please do forgive me for my naivety. I have inherited a legacy system wherein the CA which signs the certificate is of version 1. Is it possible to generate a x509 version 3 certificate which is signed by this CA?

I use openssl for this.


  • $\begingroup$ Tool specific questions are off topic here. Of course it is possible to create a chain as long as you can sign. However, X.509v3 compatible may not parse the v1 certificate, which probably means failing chain verification and therefore trust when verifying a signature. Similarly, the signing may already go wrong, or encryption / decryption if that's being used. As for the openssl command line (which goes a long way back): have you tried? $\endgroup$ – Maarten Bodewes Jun 25 '20 at 22:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.