top | item 28244859

(no title)

F30 | 4 years ago

You could do that I suppose, but at the end of the day it means you'll end up with 4 different certificate chains. In TLS, typically only one chain gets delivered. Anything else would be bloat and probably not well-supported by clients.

discuss

order

tialaramex|4 years ago

And not only are the chains different but the leaf is different each time. TLS 1.3 permits you to write any series of certificates you want that might help your peer to decide this leaf is trustworthy (not just "a chain"), but you can't provide more than one leaf.

cmeacham98|4 years ago

Why would the leaf be different? Are CAs supposed to refuse to sign certificates that have been signed by a different CA?