Join Log in
Score:0
stormdrain avatar Server

CentOS Certificate Authority increase key strength

um flag
stormdrain

I have a self signed CA that I have been using for several years. Certs that I sign/issue these days for our LAN are now getting warnings in Chrome due to "Weak Key". Is there a straightforward way with openssl to replace or upgrade the Root CA Key to use stronger crypto to avoid the "Not Secure" Chrome designation on signed certs?

28
0 + 0
ssl
Score:1
avatar Server
br flag
garethTheRed

Unfortunately, the only way to upgrade the Root CA key is to replace it with a newer, stronger, key pair and afterwards, self-sign a new Root CA certificate with the new pair.

The next steps depend on whether you decided to use subordinate CAs in your PKI design.

If you didn't go for subordinate CAs, you will need to re-sign1 all end-entity certificates with this new Root CA and the subscribers must configure their services/applications to present their newly signed end-entity certificate in their chain.

If you did opt for subordinate CAs, you will need to re-sign just the subordinate CA(s) with this new Root CA. You must then give the re-signed subordinate CA certificate(s) to all end-entity subscribers who must configure their services/applications to present this re-signed subordinate CA certificate in their chain. Note: don't re-key2 the subordinate CA here, otherwise you'll have to re-sign all end-entity certificates with the re-keyed subordinate CA.

In either case, you will need to distribute your new Root CA certificate to all relying parties and configure them all to trust this new chain.

Depending on the size of your estate, this could be quite a major undertaking. In both scenarios:

  • You re-key your Root CA once;
  • Your service/application owners will need to re-configure their service to use a replacement CA certificates in the chain;
  • You will need to distribute the Root CA to all relying-parties;

If you didn't opt for a subordinate CA, you will need to re-sign all end-entity certificates too.

1 Re-sign means the certificate is simply re-signed by the CA. The only attribute that will change is the signature, and optionally the issue/expiry dates.

2 Re-key means a new key-pair is generated for the certificate and the certificate is re-signed by the CA. No attribute other than the public key, and optionally the issue/expiry dates, change.

0 + 0
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.