Question

Is there any way we can chain our own generated key pair with an existing certificate which has been chained to a root CA (eg: verisign)? Basically my question is described in diagram below

Verisign Root CA
     |
     --> Company XYZ certificate
                     |
                     ---> Server foo certificate

Once i’ve generated key pair for server foo, how do I chain it with Company XYZ cert?

Answer 1

If Company XYZ has an Intermediate Certificate Authority certificate then you can. This kind of certificates are authorized by the root CA to issue new certificates and this fact is determined at creation time by specific properties (Basic Constraints, Key Usage, Enhanced Key Usage).

But if Company XYZ has a regular certificate, used for example to identify websites, email users or software developers, it is not possible. Even thought in practice nothing stops you from creating a new certificate and signing it with another one (if you have it’s private key), I don’t think that you will obtain a valid certificate.

So, if you have the right kind of certificate, you will have to sign foo with it. You can use makecert or open ssl for creating a new X509 Certificate. For example:

makecert -pe -n "CN=foo" -a sha1 -sky exchange -eku 1.3.6.1.5.5.7.3.1 -in "Company XYZ" -is my -ir LocalMachine -sp "Microsoft RSA SChannel Cryptographic Provider" -sy 12 -ss my -sr LocalMachine

You will need to have the certificate for the Company XYZ installed in the Local Computer/Personal location in Windows Certificate Store. The resulting certificate will be added in the same place and you will be able to export it from there in various formats (.pfx, .cer, .p7b). Also this creates the keypair for the new certificate.