Re: Can we make this kind of certificate?

[Jean-Marc Desperrier <jmdesp@xxxxxxx>]

Richard Levitte - VMS Whacker wrote:

> levitte> ...  However, there's nothing stopping you from having
> levitte> several certificates, signed by several CAs, from the same
> levitte> certificate request.  [...]
>
> [...]  I haven't analysed the effects of such action in any
> way, and before rushing to do what I said, I'd give it some extra
> careful thought if I were you. [...]
It better be correctly interpreted correctly by software, because it's 
susceptible to happen all the time.
This said it can be a cause for problems with Microsoft CAPI that relies 
too much on key based AKI/SKI.

One case were it could happen even if not intented is the earlier 
Gemplus smart card some years ago (the GPK4000  model), that were not 
able to do on-board generation, so they would pretend to generate a key 
and give back always the same one.

Moreover, this case is very similar to cross-certificates.