Is it possible to use a general public CA (like DigiCert) or an arbitrary non-Fabric CA as a parent of intermediate fabric-ca-servers ? The official doc seems to assume that you use only Fabric CAs as parents.
The intention behind this question is to mitigate the centralized nature of a single root CA.
Edit: By "non-Fabric CA" I mean any implementation other than Fabric CA that can act as a CA, e.g. OpenSSL.
Yes, you can use a third-party certificate as a root (RCA) to generate an intermediate certificate (ICA). You can configure Fabric CA to use the ICA to issue peer/orderer certificates.
If you want the Fabric CA server to use a CA signing certificate and key file which you provide, you must place your files in the location referenced by ca.certfile and ca.keyfile respectively. Both files must be PEM-encoded and must not be encrypted. More specifically, the contents of the CA certificate file must begin with -----BEGIN CERTIFICATE----- and the contents of the key file must begin with -----BEGIN PRIVATE KEY----- and not -----BEGIN ENCRYPTED PRIVATE KEY----.
Checkout the sample Fabric Config file here. The properties ca.certfile, ca.keyfile and ca.chainfile have to point to the ICA before starting the CA Server.
