ACE SSL Key & Certificate rules

Answered Question
Oct 22nd, 2008

hi,

- Is it necessary that every CSR (different common names) use/generate a unique key or a single key can be used for multiple CSRs (i.e. different common names).

I have this problem too.
0 votes
Correct Answer by Syed Iftekhar Ahmed about 8 years 1 month ago

I dont see why it shouldn't work but its definitely not recommended and is not a good idea.

From Carlisle Adams' PKI book, recommending against putting the same key

in multiple certs:

"It is too easy to "slip up" and not hold all other important aspects of

these multiple certificates constant. [...] If a single public key is

contained in multiple certificates and the private key is compromised (or

other circumstances occur that require revocation), it must be "remembered"

(or discovered) which certificates contain this key so that they may all be

revoked. [...] Having the same public key in multiple certificates can

complicate the administrative processes involved in certificate management."

http://www.amazon.com/exec/obidos/ASIN/0672323915/104-7451273-2110334

Syed Iftekhar Ahmed

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Correct Answer
Syed Iftekhar Ahmed Wed, 10/22/2008 - 11:25

I dont see why it shouldn't work but its definitely not recommended and is not a good idea.

From Carlisle Adams' PKI book, recommending against putting the same key

in multiple certs:

"It is too easy to "slip up" and not hold all other important aspects of

these multiple certificates constant. [...] If a single public key is

contained in multiple certificates and the private key is compromised (or

other circumstances occur that require revocation), it must be "remembered"

(or discovered) which certificates contain this key so that they may all be

revoked. [...] Having the same public key in multiple certificates can

complicate the administrative processes involved in certificate management."

http://www.amazon.com/exec/obidos/ASIN/0672323915/104-7451273-2110334

Syed Iftekhar Ahmed

dan.stith Wed, 11/05/2008 - 10:15

Always use a unique key per CSR. while it it technically possible the prior poster gave many of the reasons why it is a bad idea and there are many others. Just assume a key pair is unique to a CSR.

Actions

This Discussion