Public Key Infrastructure (PKI)

note-after-note-2026-may-28-pki.md

NoteAfterNote-13
Public Key Infrastructure (PKI)
Published: May 28, 2026
Link: https://gist.github.com/NoteAfterNote/0892db84c82e4f5107bc35a6931fa5de

"PKI - CA Cross-Cerificate with OpenSSL?" discussion on the openssl-users mailing list, 2004-09-22 (September 22, 2004) - 2004-09-24 (September 24, 2004): https://marc.info/?t=109589086200004&r=1&w=1

• Message 01 of 14, https://marc.info/?l=openssl-users&m=109589078005056&w=1

• Message 02 of 14, https://marc.info/?l=openssl-users&m=109592203218740&w=1 ("2004-09-23 6:45:16"), "First, use 'openssl x509 -x509toreq' to create a CSR from the certificate you want to cross-certify, then use 'openssl ca' to sign it, and use a specific extension section in the configuration file (use the -extensions option). Alternatively, the CA you want to cross-certify with could send you the CSR they used to create their CA certificate, and you could send them yours. . . ." (openssl-users mailing list, "Richard Levitte" at "2004-09-23 6:45:16")

• Message 03 of 14, https://marc.info/?l=openssl-users&m=109592778018174&w=1

• Message 04 of 14, https://marc.info/?l=openssl-users&m=109594377024271&w=1

• Message 05 of 14, https://marc.info/?l=openssl-users&m=109594767804469&w=1

• Message 06 of 14, https://marc.info/?l=openssl-users&m=109595322313954&w=1

• Message 07 of 14, https://marc.info/?l=openssl-users&m=109595392516809&w=1

• Message 08 of 14, https://marc.info/?l=openssl-users&m=109595432507809&w=1

• Message 09 of 14, https://marc.info/?l=openssl-users&m=109596444607956&w=1

• Message 10 of 14, https://marc.info/?l=openssl-users&m=109597608801445&w=1

• Message 11 of 14, https://marc.info/?l=openssl-users&m=109602168902434&w=1

• Message 12 of 14, https://marc.info/?l=openssl-users&m=109602344124753&w=1

• Message 13 of 14, https://marc.info/?l=openssl-users&m=109602358230203&w=1

• Message 14 of 14, https://marc.info/?l=openssl-users&m=109602506710845&w=1

Links

• "Cross-Certification and PKI Policy Networking": https://web.archive.org/web/20000815064542/www.entrust.com/resourcecenter/descriptions/151.htm , https://web.archive.org/web/20000815064542/www.entrust.com/resourcecenter/pdf/cross_certification.pdf , https://web.archive.org/web/20000815064542/www.entrust.com/resourcecenter/whitepapers.htm

• "easyrsa/openssl: How to cross-sign a CA for smooth transitioning (OpenVPN use-case)": https://serverfault.com/questions/1198111/easyrsa-openssl-how-to-cross-sign-a-ca-for-smooth-transitioning-openvpn-use-ca

• openssl documentation: https://docs.openssl.org/master/man1/openssl/

• OpenSSL: https://openssl.org , https://github.com/openssl/openssl , https://openssl-library.org, https://openssl-library.org/community/mailinglists/

• "Home Lab: Certificate Authority with OpenSSL": https://www.aaronrombaut.com/home-lab-certificate-authority-with-openssl/

• "Help, my OpenSSL CA expired!": https://blog.sdn.clinic/2025/12/help-my-openssl-ca-expired/

• "Getting started with OpenSSL: Cryptography basics" "Need a primer on cryptography basics, especially regarding OpenSSL? Read on.": https://opensource.com/article/19/6/cryptography-basics-openssl-part-1 , https://opensource.com/users/mkalindepauledu

• "How to use OpenSSL: Hashes, digital signatures, and more" "Dig deeper into the details of cryptography with OpenSSL: Hashes, digital signatures, digital certificates, and more": https://opensource.com/article/19/6/cryptography-basics-openssl-part-2 , https://opensource.com/users/mkalindepauledu

• "Digital Signature Standard (DSS)" (Federal Information Processing Standards Publication, FIPS 186-5, "Published: February 3, 2023"): https://csrc.nist.gov/pubs/fips/186-5/final , https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf , https://doi.org/10.6028/NIST.FIPS.186-5

• "An Overview of x.509 Certificates": https://www.ibm.com/support/pages/overview-x509-certificates , https://www.ibm.com/support/pages/system/files/inline-files/An_Overview_of_x.509_certificates.pdf

• "RSA Signing is Not RSA Decryption": https://www.cs.cornell.edu/courses/cs5430/2015sp/notes/rsa_sign_vs_dec.php in https://www.cs.cornell.edu/courses/cs5430/2015sp/notes/crypto.php ("Applied Cryptography") via https://www.cs.cornell.edu/courses/cs5430/2015sp/schedule.php ("Applied Cryptography I"), https://www.cs.cornell.edu/courses/cs5430/2015sp/ ("CS 5430 Spring 2015 :: System Security")

• "cross certificate": https://csrc.nist.gov/glossary/term/cross_certificate

• "GlobalSign Cross Certificates": https://support.globalsign.com/ca-certificates/globalsign-cross-certificates

• "How to use Cross Certificates to support Root rollover": https://groups.google.com/g/mozilla.dev.security.policy/c/WaniySf02vI

• "Using a Cross Certificate for compatibility with older devices": https://kb.ipserverone.com/knowledge-base/using-a-cross-certificate-for-compatibility-with-older-devices/

• "Cross-Certificates for Kernel Mode Code Signing": https://learn.microsoft.com/en-us/windows-hardware/drivers/install/cross-certificates-for-kernel-mode-code-signing

 

• "Traveler - Installing a root Certificate Authority (CA) on Android devices": https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0028834

• "B.3. Standard X.509 v3 Certificate Extension Reference" in the "Red Hat Certificate System 9 Administration Guide" ("Updated for Red Hat Certificate System 9.7" "Last Updated: 2023-09-15"): https://docs.redhat.com/en/documentation/red_hat_certificate_system/9/html-single/administration_guide/index , https://docs.redhat.com/en/documentation/red_hat_certificate_system/9/pdf/administration_guide/Red_Hat_Certificate_System-9-Administration_Guide-en-US.pdf

• "What is a Root CA?": https://developers.google.com/public-key-infrastructure/faq/what-is-a-root-ca

• "The PKI Definitions and Terms You Need to Know": https://www.keyfactor.com/blog/pki-definition-terms-to-know/

• "What is PKI? A Public Key Infrastructure Definitive Guide": https://www.keyfactor.com/education-center/what-is-pki/

• "Public CA vs Private CA": https://www.qcecuring.com/education/pki/public-ca-vs-private-ca

• "PKI Trust Models": https://www.qcecuring.com/education/pki/pki-trust-models

• "Root CA vs Intermediate CA": https://www.qcecuring.com/education/pki/root-ca-vs-intermediate-ca

• "PKI Hierarchy Design (1-tier, 2-tier, 3-tier)": https://www.qcecuring.com/education/pki/pki-hierarchy-design

 

• VirusTotal: https://www.virustotal.com/gui/home/url

• "Dory - Certificate (RSA/CSR/x5": https://play.google.com/store/apps/details?id=io.tempage.dorycert

• OpenKeychain (for Android), "OpenKeychain is an OpenPGP implementation for Android.": https://github.com/open-keychain/open-keychain

• Termux application, "Termux is an Android terminal application and Linux environment.": https://github.com/termux/termux-app

• XCA - X Certificate and Key Management: https://github.com/chris2511/xca

• easy-rsa, "easy-rsa is a CLI utility to build and manage a PKI CA. In layman's terms, this means to create a root certificate authority, and request and sign certificates, including intermediate CAs and certificate revocation lists (CRL).": https://github.com/OpenVPN/easy-rsa

 

• "RSA Algorithm - How does it work? - I'll PROVE it with an Example! -- Cryptography - Practical TLS": https://www.youtube.com/watch?v=Pq8gNbvfaoM via https://www.youtube.com/@PracticalNetworking

• "Fundamental X.509 PKI in Theory and OpenSSL" course: https://www.youtube.com/playlist?list=PLWjMI9CAmVU4AHEMlq_SUuIAgeCDOdrvO via https://www.youtube.com/@cyrillgossi

 

• KeePassDX, "Notes" template: https://github.com/Kunzisoft/KeePassDX

• LockScreenNotes: https://github.com/NilsFo/LockScreenNotes

 

• https://archive.ph

• https://web.archive.org