Ben Laurie wrote:
>
> Juergen Rensen wrote:
> >
> > Hi,
> >
> > I understand that the Global ID cert actually consists of two chained
> > certificates. Is there a way that someone with a valid Global ID (ie a
> > bank) can sign a new certificate (ie for a merchant server) which will
> > cause browsers to use strong encryption when connecting to the merchant
> > server?
> >
> > I guess Versigin and the USA wouldn't allow that, right?
>
> Damn right!
>
Yes, you can't use an end user certificate as a CA (well there was this
one broken one you could...) with most software because it isn't marked
as being a valid CA. Either by having the CA flag set to FALSE in
basicConstraints or implicitly because basicConstraints is absent and
probably not having the right keyUsage bits set either.
I believe Verisign has certified some US banks to issue their own global
server IDs by siging a CA certificate with their global server root, and
with suitable path length protection.
Steve.
--
Dr Stephen N. Henson. http://www.drh-consultancy.demon.co.uk/
Personal Email: [EMAIL PROTECTED]
Senior crypto engineer, Celo Communications: http://www.celocom.com/
Core developer of the OpenSSL project: http://www.openssl.org/
Business Email: [EMAIL PROTECTED] PGP key: via homepage.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
