<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<br>
<br>
<div class="moz-cite-prefix">On 4/4/2017 5:20 μμ, Peter Bowen wrote:<br>
</div>
<blockquote type="cite"
cite="mid:2004CBC1-5AA7-4E8F-A48A-B41209BF16A7@amzn.com">
<div>
<blockquote type="cite" class="">
<div class="">
<div bgcolor="#FFFFFF" text="#000000" class="">By keeping
exactly the same DN? Does this align with 4.1.2.6 of RFC
5280 that require unique DNs under one Issuing CA
(probably a Root CA in this case)<br class="">
</div>
</div>
</blockquote>
<div><br class="">
</div>
<div style="orphans: 2; widows: 2;">I’m not sure what part of
4.1.2.6 says this is not allowed. In fact it says: "<span
style="font-size: 13.3333px; orphans: 2; widows: 2;"
class="">A CA </span><span style="font-size: 13.3333px;
orphans: 2; widows: 2;" class="">MAY issue more than one
certificate with the same DN to the same </span><span
style="font-size: 13.3333px; orphans: 2; widows: 2;"
class="">subject entity.</span><font class="" size="2">”</font></div>
<div><span style="font-size: 13.3333px; orphans: 2; widows: 2;"
class=""><br class="">
</span></div>
<div style="orphans: 2; widows: 2;"><font class="" size="2">Consider
a situation where CAs are licensed by a central authority.
A single legal entity may operate multiple CAs. This sort
of requirement exists in other industries; for example the
requirement in many US states that each restaurant kitchen
be inspected and licensed even if a single company owns
multiple kitchens. In the case of a licensed CA, it is
clear that it is a specific subject entity. Therefore
issuing more than multiple certificates with the same DN to
that entity with different key pairs is fine.</font></div>
<div><br class="">
</div>
</div>
</blockquote>
<br>
It says exactly the following:<br>
<pre>"The DN MUST be unique for each subject entity certified by the one CA as defined by the issuer field. A CA MAY issue more than one certificate with the same DN to the same subject entity."</pre>
I guess I was confused by the first sentence because having more
than one Certificate per subject entity per CA (as the Issuer) with
the same DN would break the uniqueness. I read it as uniqueness of
DNs per CA where you read it as uniqueness of a "subject entity"
that can have the same DN but multiple certificates with the same
DN. Now I can understand your interpretation. <br>
<br>
<blockquote type="cite"
cite="mid:2004CBC1-5AA7-4E8F-A48A-B41209BF16A7@amzn.com">
<div>
<blockquote type="cite" class="">
<div class="">
<div bgcolor="#FFFFFF" text="#000000" class="">
<blockquote
cite="mid:2A526E69-12F7-4710-8051-6CFF6390806D@amzn.com"
type="cite" class="">
<div class="">
<div class=""><br class="">
</div>
<div class="">While not mentioned, two different
Issuing CAs can have the same key pair. <br
class="">
</div>
</div>
</blockquote>
<br class="">
I don't remember reading any requirement that prevents
this.<br class="">
<br class="">
<blockquote
cite="mid:2A526E69-12F7-4710-8051-6CFF6390806D@amzn.com"
type="cite" class="">
<div class="">
<div class=""><br class="">
</div>
<div class="">So, to answer your question: I would say
those are both the same “Issuing CA”. <br class="">
</div>
</div>
</blockquote>
<br class="">
If two CA Certificates have exactly the same DN as in the
example above, we agree that we are talking about the same
"Issuing CA". However, we need to understand if the re-key
process of an Issuing CA is in accordance with RFC 5280
since this is not a "self-issued certificate" that 5280
explicitly allows for keeping the same DN.<br class="">
</div>
</div>
</blockquote>
<br class="">
</div>
<div>As long as it is the same subject entity, then you can
re-key.</div>
<div><br class="">
</div>
<div>Consider certificates issued with the subject DN: CN=*.<a
href="http://google.com" class="" moz-do-not-send="true">google.com</a>,
O=Google Inc, L=Mountain View, ST=California, C=US. crt.sh
shows many many with this DN with different keys: <a
href="https://crt.sh/?cn=*.google.com&dir=%5E&sort=2"
class="" moz-do-not-send="true">https://crt.sh/?cn=*.google.com&dir=^&sort=2</a>
There are millions more similar cases where the CA has “renewed”
a certificate with a new key or "rekeyed" a certificate. Are
you saying that CAs are somehow different from other entities?</div>
</blockquote>
<br>
No, I think your example makes it perfectly clear :)<br>
<br>
<br>
Thank you,<br>
Dimitris.<br>
<br>
</body>
</html>