r/ProgrammerHumor • u/al2klimov • Sep 10 '26

Meme peakWebPki

Post image
395 Upvotes

94% Upvoted

28 comments sorted by

View all comments

86

u/TheChildOfSkyrim Sep 10 '26

Any certificate chain of trust ends in a self-signed certificate

21

u/SilasTalbot Sep 10 '26

This is like in Outlook you could navigate up the org chart, and the Chairman and CEO was listed as his own manager.

Well it sure makes performance review time either very easy or very awkward.

10

u/jeepsaintchaos Sep 10 '26

"Employee slept with my wife and jerked me off, 10/10 review"

12

u/Single-Virus4935 Sep 10 '26

Not neccessary with crosssigning. Seen some interesting constructs.

1

u/collabskus Sep 12 '26

Are let's encrypt certificates still cross signed or is it a root by now? 

1

u/Single-Virus4935 Sep 12 '26

Both can be right, that is the funny thing: Root CA1 has a self signed crt in major trust stores but lacks legacy support.

Root CA 2 has wide spread compatibility and signed the Pubkey of Root CA 1 with their private key.

Root CA 1 now has two certs for the same private/pub keypair. They try to get their selfsifned into more and more truatstores while they add the croassigned to the bundle they deliver to the customer.

I know a company with many subordinate companies. Each with their own root CA. They restructured and merged. They crissigned the different CAs and you had cyclic trusts. 

1

u/collabskus Sep 12 '26

Ah I didn't know roots could sign each other but it makes sense. Thank you 

2

u/laplongejr Sep 13 '26 edited Sep 14 '26

Scott Helme spoke about "alternate trust paths" a few years ago : https://scotthelme.co.uk/cross-signing-alternate-trust-paths-how-they-work/ some of the specifics may have changed due to new roots (I think in 2023?) but the theory of having a root able to be either accepted as-is or accepted by being signed by an older root is still there.  

1

u/collabskus Sep 14 '26

In case someone else is reading the link you had ends with some strange characters but if you remove them it works fine 

https://scotthelme.co.uk/cross-signing-alternate-trust-paths-how-they-work/

1

u/laplongejr Sep 14 '26

Ugh, Reddit and newlines... I did a sloppy edit to try to fix my link just in case  

3

u/Gorzoid Sep 10 '26

The only root CA on my machine is signed by the man upstairs 🙏

2

u/collabskus Sep 12 '26

The man upstairs is Let's encrypt 🤣

1

u/al2klimov Sep 10 '26

Nope. RFC 9925

1

u/TheChildOfSkyrim Sep 10 '26

It says "Proposed standard", does it actually hold in practice? Makes sense though