It would be nice to spread the trust around a bit, so we don't have to rely on just one root in any instance.
Is it possible to have a single certificate signed by more than one CA?
5 Answers
Yes, a certificate may be signed by multiple CA's. The term for this is cross-signing. See https://letsencrypt.org/certificates/ for a good description of how this works. Note that in the diagram at the top of the page, several of Let's Encrypt's intermediate certificates are signed by two root certificates (ISRG Root X1 and DST Root CA X3). Also, see https://security.stackexchange.com/questions/14043/what-is-the-use-of-cross-signing-certificates-in-x-509 for more info.
No, one single certificate is signed by only one CA. But you can have two so-called cross-signed certificates, which share the same private and public key and the same common name and other common information, but signed by two different CAs. In that case, they are both equally valid alternatives for the validation of a certificate on a lower level which is issued by one of them.
Related