It is a shame that you cannot have a cert signed by multiple CAs.
(The format seems like it would allow it, but nothing supports it, and in practice CAs demand the ability to actually modify some fields, and then sign that.)
(The format seems like it would allow it, but nothing supports it, and in practice CAs demand the ability to actually modify some fields, and then sign that.)
For example, the initial Let's Encrypt Authority X3 was signed by both their own (new, not-yet-universally-trusted) ISRG Root X1, and the universally-trusted third-party IdenTrust DST Root CA X3.
One crucial detail is that it isn't the same certificate. Rather, it is two separate certificates which just so happen to be using the same key pair, so the leaf cert is in essence signed by both intermediate certs at once.
I wonder if it would be possible to do the same thing on your own, actually: can a server present two completely separate cert chains to a connecting client - as long as the leaves use the same key pair? Technically AFAIK the only requirements should be 1) the key pair in use for the connection matches the cert, 2) the domain matches the cert's Subject, and 3) the cert is trusted, so at first glance it might be possible...
Of course, the browsers don't use the "certificate_authorities" because the list would be hilariously large for a TLS CLient Hello packet.
shame it wasn't adopted. rent seeking CAs would never go for it.
This would effectively be the same "root CAs come pre-installed" but they would be notaries rather than root CAs, with a predefined trust policy (maybe minimum of 2 notaries per leaf certificate)
Users would still just see a green lock icon same as before, no action needed.
Another option: Use ACME together with ARI (RFC 9773). The client checks ARI data every hour. If the cert needs to be replaced – for example like in this scenario – the CA will inform the client, which in turn would then request a new cert.
I know it’s not convenient to automate for every kind of device though. I guess in some of those cases it might be better to have a load balancer in front of the device. Or use an alternative PKI.
Certificates are not the same as the public key; multiple certs sharing the same key is essentially the way around this. It's not as elegant as identical signing of the same cert, but it could work.
And turning fields like issuer and serial into arrays risks someone accidentally using index 0 for one field and index 1 for another.
Combine that with the insane back-and-forth nightmare that the issuance process would turn into, and I have a very hard time seeing the benefit in it. After all, nobody is stopping you from requesting multiple certs independently, watching the revocation logs, and switching to the backup when required.
And then the browser could present these badges in a nice way to the user.
And then you have that one website trying to collect them all.
I don't think that's the right way to think about it.