[CentOS] Why is localhost self-signed cert a CA cert?

Robert Moskowitz rgm at htt-consult.com
Wed Jan 9 00:42:40 UTC 2013


On 01/08/2013 06:38 PM, Gordon Messmer wrote:
> On 01/08/2013 03:27 PM, Robert Moskowitz wrote:
>> I just checked a couple RFCs. If this is a root CA cert, of course it is
>> self-signed. By definition.
>
> Yes.
>
>> But a self-signed server cert is not a CA root cert....
>
> Yes, it is.  A certificate is a root cert unless some other 
> certificate has signed it.  x509 creates a chain of trust.  The root 
> of that chain is the certificate which has no other certificate's 
> signature on it.  A self-signed cert is its own root, and all root 
> certificates are self-signed.
>
CA:TRUE means it is a signing cert.  In RFC 5280, app C.2 end-entity cert:

    (g)  the certificate is an end entity certificate, as the basic
         constraints extension is not present;





More information about the CentOS mailing list