# Generate version 3 x509 certificate from version 1 CA

Please do forgive me for my naivety. I have inherited a legacy system wherein the CA which signs the certificate is of version 1. Is it possible to generate a x509 version 3 certificate which is signed by this CA?

I use openssl for this.

Thanks

• Tool specific questions are off topic here. Of course it is possible to create a chain as long as you can sign. However, X.509v3 compatible may not parse the v1 certificate, which probably means failing chain verification and therefore trust when verifying a signature. Similarly, the signing may already go wrong, or encryption / decryption if that's being used. As for the openssl command line (which goes a long way back): have you tried? – Maarten Bodewes Jun 25 '20 at 22:44