0

For testing purposes I want to test cross-signing certificates for Windows driver signing. I understand the general concept: Two root CAs, one root CA cross-signs the other root CA's public key.

However, I couldn't find any information on how to cross-sign the root CA's public key exactly. When I simply sign the public key with the cross-certificate in OpenSSL, the cross-certificate is presented as the root certificate. Should it be like that? If not, does anybody what commands can be used to cross-sign a root CA's public key?

D.O.
  • 600
  • 3
  • 9

1 Answers1

2

Cross-certification in Windows is done via certreq.exe tool:

certreq -policy <policy.inf> <certtocrosssign.cer> <outreq.csr>

where <policy.inf> is INF file that defines cross-certificate contents and constratints. <certtocrosssign.cer> is a path to a certificate file you are cross-signing. And the last parameter <outreq.csr> is the path to cross-certificate request. Before executing the command, make sure that you have a certificate with Qualified Subordination (1.3.6.1.4.1.311.10.3.10) EKU. This key is used to sign request.

When I simply sign the public key with the cross-certificate in OpenSSL, the cross-certificate is presented as the root certificate.

no, cross-certificate is not root certificate (Subject and Issuer doesn't match). Issuer is the CA used to sign the request and Subject is the subject of CA you are certifying.

For more details, please refer to Microsoft whitepaper on cross-certification. Unfortunately, Microsoft removed it from their servers and you can get a copy from non-Microsoft web sites. For example, a copy downloadable from my personal weblog: 34 PKI & ADCS Whitepapers You Must Read. The document is called [Win2k3] Planning and Implementing Cross-Certification and Qualified Subordination Using Windows Server 2003.

Crypt32
  • 5,750
  • 12
  • 24