How does it work: Found one SSL certificate two different chains and two different root CAs

1
votes

I bought an SSL Certificate from GeoTrust.

On checking the certificate chain on different Devices I found two different chains. Both chain are valid!

On chain ends in Root-CA C=US, O=Equifax, OU=Equifax Secure Certificate Authority and the other one in Root-CA C=US, O=GeoTrust Inc., CN=GeoTrust Global CA.

The different between this chains are in the first chain "GeoTrust Global CA" is signed by "Equifax Secure Certificate Authority" and in at the second "GeoTrust Global CA" is self-signed. But in both chain the Fingerprint of "GeoTrust Global CA" is "C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E", only the Serial Number is different.

How is this possible? I thought ssl certificates, the fingerprints of them and the cahins are unique!

Chain 1)

1a) C=US, O=GeoTrust Inc., OU=Domain Validated SSL, CN=GeoTrust DV SSL CA sign by C=US, O=GeoTrust Inc., CN=GeoTrust Global CA

Data:
    Version: 3 (0x2)
    Serial Number: 145106 (0x236d2)
    Signature Algorithm: sha1WithRSAEncryption
    Issuer: C=US, O=GeoTrust Inc., CN=GeoTrust Global CA
    Validity
        Not Before: Feb 26 21:32:31 2010 GMT
        Not After : Feb 25 21:32:31 2020 GMT
    Subject: C=US, O=GeoTrust Inc., OU=Domain Validated SSL, CN=GeoTrust DV SSL CA
    X509v3 extensions:
        X509v3 Key Usage: critical
            Certificate Sign, CRL Sign
        X509v3 Subject Key Identifier:
            8C:F4:D9:93:0A:47:BC:00:A0:4A:CE:4B:75:6E:A0:B6:B0:B2:7E:FC
        X509v3 Authority Key Identifier:
            keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E

1b) C=US, O=GeoTrust Inc., CN=GeoTrust Global CA sign by C=US, O=Equifax, OU=Equifax Secure Certificate Authority

Data:
    Version: 3 (0x2)
    Serial Number: 1227750 (0x12bbe6)
    Signature Algorithm: sha1WithRSAEncryption
    Issuer: C=US, O=Equifax, OU=Equifax Secure Certificate Authority
    Validity
        Not Before: May 21 04:00:00 2002 GMT
        Not After : Aug 21 04:00:00 2018 GMT
    Subject: C=US, O=GeoTrust Inc., CN=GeoTrust Global CA
    X509v3 extensions:
        X509v3 Authority Key Identifier:
            keyid:48:E6:68:F9:2B:D2:B2:95:D7:47:D8:23:20:10:4F:33:98:90:9F:D4

        X509v3 Subject Key Identifier:
            C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E
        X509v3 Basic Constraints: critical
            CA:TRUE

1c) Root-CA C=US, O=Equifax, OU=Equifax Secure Certificate Authority

Data:
    Version: 3 (0x2)
    Serial Number: 903804111 (0x35def4cf)
    Signature Algorithm: sha1WithRSAEncryption
    Issuer: C=US, O=Equifax, OU=Equifax Secure Certificate Authority
    Validity
        Not Before: Aug 22 16:41:51 1998 GMT
        Not After : Aug 22 16:41:51 2018 GMT
    Subject: C=US, O=Equifax, OU=Equifax Secure Certificate Authority
    X509v3 extensions:
        X509v3 Private Key Usage Period:
            Not After: Aug 22 16:41:51 2018 GMT
        X509v3 Key Usage:
            Certificate Sign, CRL Sign
        X509v3 Authority Key Identifier:
            keyid:48:E6:68:F9:2B:D2:B2:95:D7:47:D8:23:20:10:4F:33:98:90:9F:D4

        X509v3 Subject Key Identifier:
            48:E6:68:F9:2B:D2:B2:95:D7:47:D8:23:20:10:4F:33:98:90:9F:D4

Chain 2)

2a) C=US, O=GeoTrust Inc., OU=Domain Validated SSL, CN=GeoTrust DV SSL CA sign by C=US, O=GeoTrust Inc., CN=GeoTrust Global CA

Data:
    Version: 3 (0x2)
    Serial Number: 145106 (0x236d2)
    Signature Algorithm: sha1WithRSAEncryption
    Issuer: C=US, O=GeoTrust Inc., CN=GeoTrust Global CA
    Validity
        Not Before: Feb 26 21:32:31 2010 GMT
        Not After : Feb 25 21:32:31 2020 GMT
    Subject: C=US, O=GeoTrust Inc., OU=Domain Validated SSL, CN=GeoTrust DV SSL CA
    X509v3 extensions:
        X509v3 Key Usage: critical
            Certificate Sign, CRL Sign
        X509v3 Subject Key Identifier:
            8C:F4:D9:93:0A:47:BC:00:A0:4A:CE:4B:75:6E:A0:B6:B0:B2:7E:FC
        X509v3 Authority Key Identifier:
            keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E

2b) Root-CA C=US, O=GeoTrust Inc., CN=GeoTrust Global CA

Data:
    Version: 3 (0x2)
    Serial Number: 144470 (0x23456)
    Signature Algorithm: sha1WithRSAEncryption
    Issuer: C=US, O=GeoTrust Inc., CN=GeoTrust Global CA
    Validity
        Not Before: May 21 04:00:00 2002 GMT
        Not After : May 21 04:00:00 2022 GMT
    Subject: C=US, O=GeoTrust Inc., CN=GeoTrust Global CA
    X509v3 extensions:
        X509v3 Basic Constraints: critical
            CA:TRUE
        X509v3 Subject Key Identifier:
            C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E
        X509v3 Authority Key Identifier:
            keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E
1
sslopensslssl-certificatex509certificatex509
Which are the two certificates that you think are identical? - user207421
Subject and fingerprint of 1b and 2b! But the issuer are different. How it is possible that 1b and 2b have the same Fingerprint "C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E"? I thought the fingerprint includes the issuer Information. In this case the fingerprints must be different. - TimCgn74
The serial numbers are different. - user207421

1 Answers

4
votes

1b is a "cross certificate"; a root certificate for Geotrust issued by Equifax. 2b is the same key, but a self-signed root.

Cross certificates are typically used to make a root certificate trusted before it as been accepted into the Mozilla/Microsoft/etc root programs. When the root has been accepted by those programs, it can be used as a normal self-signed certificate.