Public Key Infrastructure (PKI)

note-after-note-2026-may-28-pki.md

NoteAfterNote-13
Public Key Infrastructure (PKI)
Published: May 28, 2026
Link: https://gist.github.com/NoteAfterNote/0892db84c82e4f5107bc35a6931fa5de
Updated: September 14, 2026

"PKI - CA Cross-Cerificate with OpenSSL?" discussion on the openssl-users mailing list, 2004-09-22 (September 22, 2004) - 2004-09-24 (September 24, 2004): https://marc.info/?t=109589086200004&r=1&w=1

• Message 01 of 14, https://marc.info/?l=openssl-users&m=109589078005056&w=1

• Message 02 of 14, https://marc.info/?l=openssl-users&m=109592203218740&w=1 ("2004-09-23 6:45:16"), "First, use 'openssl x509 -x509toreq' to create a CSR from the certificate you want to cross-certify, then use 'openssl ca' to sign it, and use a specific extension section in the configuration file (use the -extensions option). Alternatively, the CA you want to cross-certify with could send you the CSR they used to create their CA certificate, and you could send them yours. . . ." (openssl-users mailing list, "Richard Levitte" at "2004-09-23 6:45:16")

• Message 03 of 14, https://marc.info/?l=openssl-users&m=109592778018174&w=1

• Message 04 of 14, https://marc.info/?l=openssl-users&m=109594377024271&w=1

• Message 05 of 14, https://marc.info/?l=openssl-users&m=109594767804469&w=1

• Message 06 of 14, https://marc.info/?l=openssl-users&m=109595322313954&w=1

• Message 07 of 14, https://marc.info/?l=openssl-users&m=109595392516809&w=1

• Message 08 of 14, https://marc.info/?l=openssl-users&m=109595432507809&w=1

• Message 09 of 14, https://marc.info/?l=openssl-users&m=109596444607956&w=1

• Message 10 of 14, https://marc.info/?l=openssl-users&m=109597608801445&w=1

• Message 11 of 14, https://marc.info/?l=openssl-users&m=109602168902434&w=1

• Message 12 of 14, https://marc.info/?l=openssl-users&m=109602344124753&w=1

• Message 13 of 14, https://marc.info/?l=openssl-users&m=109602358230203&w=1

• Message 14 of 14, https://marc.info/?l=openssl-users&m=109602506710845&w=1

Links

• "Cross-Certification and PKI Policy Networking": https://web.archive.org/web/20000815064542/www.entrust.com/resourcecenter/descriptions/151.htm , https://web.archive.org/web/20000815064542/www.entrust.com/resourcecenter/pdf/cross_certification.pdf , https://web.archive.org/web/20000815064542/www.entrust.com/resourcecenter/whitepapers.htm

• "easyrsa/openssl: How to cross-sign a CA for smooth transitioning (OpenVPN use-case)": https://serverfault.com/questions/1198111/easyrsa-openssl-how-to-cross-sign-a-ca-for-smooth-transitioning-openvpn-use-ca

• openssl documentation: https://docs.openssl.org/master/man1/openssl/

• OpenSSL: https://openssl.org , https://github.com/openssl/openssl , https://openssl-library.org, https://openssl-library.org/community/mailinglists/

• "CA hierarchy / pathlen:0" discussion on the openssl-users mailing list, 2013-08-20 (August 20, 2013) - 2013-08-22 (August 22, 2013): https://marc.info/?t=137710041800004&r=1&w=1

• "x509 restrict the intermediate CA to sign only end user certificates": https://security.stackexchange.com/questions/241008/x509-restrict-the-intermediate-ca-to-sign-only-end-user-certificates

• "Home Lab: Certificate Authority with OpenSSL": https://www.aaronrombaut.com/home-lab-certificate-authority-with-openssl/

• "OpenSSL Certificate Authority": https://jamielinux.com/docs/openssl-certificate-authority/index-full.html

• "Create Your Own SSL Certificate Authority for Local HTTPS Development": https://deliciousbrains.com/ssl-certificate-authority-for-local-https-development/

• "How to Build a Root CA & Intermediate CA with OpenSSL": https://medium.com/@sureshchand.rhce/how-to-build-a-root-ca-intermediate-ca-with-openssl-eba1c73d1591 , https://archive.ph/zMfNB

• "Advanced example: Use configs with a Nginx service" ("This example is divided into two parts. The first part is all about generating the site certificate and does not directly involve Docker configs at all, but it sets up the second part, where you store and use the site certificate as a series of secrets and the Nginx configuration as a config. . . .") in "Store configuration data using Docker Configs": https://docs.docker.com/engine/swarm/configs#advanced-example-use-configs-with-a-nginx-service via https://docs.docker.com/engine/swarm/configs ("Store configuration data using Docker Configs")

• "BUILDING A ROOT CA AND AN INTERMEDIATE CA USING OPENSSL on UBUNTU": https://dadhacks.org/2023/09/26/building-a-root-ca-and-an-intermediate-ca-using-openssl-on-ubuntu/

• "How to Set Up Intermediate CA Certificates in Istio" "How to configure Istio with intermediate CA certificates for a proper PKI hierarchy, including generation, installation, and chain management.": https://oneuptime.com/blog/post/2026-02-24-how-to-set-up-intermediate-ca-certificates-in-istio/view

• "Help, my OpenSSL CA expired!": https://blog.sdn.clinic/2025/12/help-my-openssl-ca-expired/

• "Getting started with OpenSSL: Cryptography basics" "Need a primer on cryptography basics, especially regarding OpenSSL? Read on.": https://opensource.com/article/19/6/cryptography-basics-openssl-part-1 , https://opensource.com/users/mkalindepauledu

• "How to use OpenSSL: Hashes, digital signatures, and more" "Dig deeper into the details of cryptography with OpenSSL: Hashes, digital signatures, digital certificates, and more": https://opensource.com/article/19/6/cryptography-basics-openssl-part-2 , https://opensource.com/users/mkalindepauledu

• "How to build your own public key infrastructure": https://blog.cloudflare.com/how-to-build-your-own-public-key-infrastructure/

• "Digital Signature Standard (DSS)" (Federal Information Processing Standards Publication, FIPS 186-5, "Published: February 3, 2023"): https://csrc.nist.gov/pubs/fips/186-5/final , https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf , https://doi.org/10.6028/NIST.FIPS.186-5

• "An Overview of x.509 Certificates": https://www.ibm.com/support/pages/overview-x509-certificates , https://www.ibm.com/support/pages/system/files/inline-files/An_Overview_of_x.509_certificates.pdf

• "RSA Signing is Not RSA Decryption": https://www.cs.cornell.edu/courses/cs5430/2015sp/notes/rsa_sign_vs_dec.php in https://www.cs.cornell.edu/courses/cs5430/2015sp/notes/crypto.php ("Applied Cryptography") via https://www.cs.cornell.edu/courses/cs5430/2015sp/schedule.php ("Applied Cryptography I"), https://www.cs.cornell.edu/courses/cs5430/2015sp/ ("CS 5430 Spring 2015 :: System Security")

• "cross certificate": https://csrc.nist.gov/glossary/term/cross_certificate

• "GlobalSign Cross Certificates": https://support.globalsign.com/ca-certificates/globalsign-cross-certificates

• "How to use Cross Certificates to support Root rollover": https://groups.google.com/g/mozilla.dev.security.policy/c/WaniySf02vI

• "Using a Cross Certificate for compatibility with older devices": https://kb.ipserverone.com/knowledge-base/using-a-cross-certificate-for-compatibility-with-older-devices/

• "Cross-Certificates for Kernel Mode Code Signing": https://learn.microsoft.com/en-us/windows-hardware/drivers/install/cross-certificates-for-kernel-mode-code-signing

 

• "Traveler - Installing a root Certificate Authority (CA) on Android devices": https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0028834

• "B.3. Standard X.509 v3 Certificate Extension Reference" in the "Red Hat Certificate System 9 Administration Guide" ("Updated for Red Hat Certificate System 9.7" "Last Updated: 2023-09-15"): https://docs.redhat.com/en/documentation/red_hat_certificate_system/9/html-single/administration_guide/index , https://docs.redhat.com/en/documentation/red_hat_certificate_system/9/pdf/administration_guide/Red_Hat_Certificate_System-9-Administration_Guide-en-US.pdf

• "What is a Root CA?": https://developers.google.com/public-key-infrastructure/faq/what-is-a-root-ca

• "The PKI Definitions and Terms You Need to Know": https://www.keyfactor.com/blog/pki-definition-terms-to-know/

• "What is PKI? A Public Key Infrastructure Definitive Guide": https://www.keyfactor.com/education-center/what-is-pki/

• "Public CA vs Private CA": https://www.qcecuring.com/education/pki/public-ca-vs-private-ca

• "PKI Trust Models": https://www.qcecuring.com/education/pki/pki-trust-models

• "Root CA vs Intermediate CA": https://www.qcecuring.com/education/pki/root-ca-vs-intermediate-ca

• "PKI Hierarchy Design (1-tier, 2-tier, 3-tier)": https://www.qcecuring.com/education/pki/pki-hierarchy-design

 

• VirusTotal: https://www.virustotal.com/gui/home/url

• "Dory - Certificate (RSA/CSR/x5": https://play.google.com/store/apps/details?id=io.tempage.dorycert

• OpenKeychain (for Android), "OpenKeychain is an OpenPGP implementation for Android.": https://github.com/open-keychain/open-keychain

• Termux application, "Termux is an Android terminal application and Linux environment.": https://github.com/termux/termux-app

• XCA - X Certificate and Key Management: https://github.com/chris2511/xca

• easy-rsa, "easy-rsa is a CLI utility to build and manage a PKI CA. In layman's terms, this means to create a root certificate authority, and request and sign certificates, including intermediate CAs and certificate revocation lists (CRL).": https://github.com/OpenVPN/easy-rsa

 

• "RSA Algorithm - How does it work? - I'll PROVE it with an Example! -- Cryptography - Practical TLS": https://www.youtube.com/watch?v=Pq8gNbvfaoM via https://www.youtube.com/@PracticalNetworking

• "Fundamental X.509 PKI in Theory and OpenSSL" course: https://www.youtube.com/playlist?list=PLWjMI9CAmVU4AHEMlq_SUuIAgeCDOdrvO via https://www.youtube.com/@cyrillgossi

 

• KeePassDX, "Notes" template: https://github.com/Kunzisoft/KeePassDX

• LockScreenNotes: https://github.com/NilsFo/LockScreenNotes

 

• https://archive.ph
• https://archive.is
• https://web.archive.org