Subject: Using a Web-Server cert as a CA-cert

From: "Anders Rundgren" <[email-masked]>
Date: Thu, 1 Nov 2001 17:25:32 +0100

Hi,
If you want to issue certificates belonging to an organization of some kind,
you always run into the problem for relying parties in how they are going to recognize
this CA.  A way to "cheat" would be to actually buy a standard VeriSign
web-server certificate and use that in the local CA.  Then the "domain"
of the issuer would at least be trustworthy (up to the same limit as the
issuing of web-server certificates are today).

What are the potential problems with this approach?

I would appreciate your input on this!

Regards
Anders Rundgren
X-OBI

---

From: Stephen Kent <[email-masked]>
Date: Thu, 1 Nov 2001 11:49:37 -0500

>I would appreciate your input on this!

A web server cert is an EE cert, not a CA cert, and thus should be 
rejected by path validation algorithms when used as a CA cert.

Steve