Step CA as a Sub-CA (existing root CA) considerations with Intermediates

[fibbs]

Hi folks,

I am still somewhat new to step-ca and I love it a lot!

One thing I have been wondering without really finding an easy answer is, how would one handle a step-ca as a sub-CA of an existing one (like an existing Microsoft CA in an organisation): Step-ca, as far as I have learned, ALWAYS deploys with a root certificate and an intermediate, and also as far as I have learned, it will always send out the Leaf Certificate plus the one that issued the certificate (the intermediate) when issuing certificates using ACME or whatever method.

Now, let's imagine we have step-ca as sub of another CA, then I would have to have my, say web servers using step-cas certificates, present a chain of the leaf, step-ca's intermediate, and step-ca's root, as other clients would be trusting the "upper level" root certificate. Is that possible at all?

It seems it all comes down to whether a setup without an intermediate would actually be possible, plus whether it is configurable to hand out the root cert itself. If we think about even more complex scenarios, where, lets assume, a step CA is the root CA of an organisation, then we have a sub CA for the department of whatever, and they use a sub CA for their machine certificates, and one for the web services, or something like this.... I suppose it would be quite difficult to handle the "Root CA -> Intermediate of the Root CA -> actual Sub CA's root -> Sub-CA's Intermediate -> Leaf chain.

Looking for some enlightenment here :-)

Thanks a lot in advance.

[tashian]

I'm happy to answer specific questions about using step-ca as a sub-CA.
But, before I do, have you seen our tutorial for this?

[fibbs]

Hey tashian,

actually, yes, I did read this tutorial, but after you asking me I did again and I believe, there is one key point that I did not understand at the first time reading, and I believe now I got it more clear. When using step-ca as a subordinate of another one, the "upper one" being either another step-ca or any other CA, you use the "upper level" certificate authority's root certificate as the root certificate of the step-ca subordinate. I have attached a drawing that illustrates how I understood it, and it makes totally sense like that for me now.

I also have understood that when using a longer chain you can concatenate the intermediate CA certificates, which I believe will make ACME and other provisioners to deliver certificates containing the entire chain.

So, I hope I got this correctly. If so, it's now clear to me. Thanks a lot!

[tashian]

I'm not able to give feedback on specific PKI designs, but I will say that you have some options when it comes to deploying multiple step CA instances:

• You can deploy multiple intermediates without increasing the overall chain length of your PKI
• Or, multiple step CA instances could use the same intermediate signing CA, if you don't care which CA issued a given leaf certificate (this is sort of a "high availability" setup and we have some docs on that here— and, if high availability is interesting to you, we sell a commercial version of Step CA that's designed for high availability use cases, with some additional features for that — I'd be happy to connect you with our sales folks if you're interested.)
• Every step CA server must be configured with a root CA certificate. Where, by "root" I mean a self-signed certificate that's marked as a CA.

I hope this helps!