Multiple CAs signing a single Cert/CSR?

On changes to SSL/TLS: the SSL/TLS protocol sends certificates as anonymous blobs which can have any size, up to about 16 MB (which is ludicrous). The protocol itself needs not be changed if one wants to use some new certificate formats.

SSL/TLS implementations expects the blobs to be encoded X.509 certificates. Such a certificate has room for a single issuer (the CA name is written in it) and a single signature. So you cannot have a "multi-signed certificate" within the bounds of the existing X.509 standard. You could get several certificates, with the same public key in each, and then you would only need some sort of convention so that the SSL client software does not mind receiving more than one certificate for the server, and checks them all.

About issuing the certificates: a certificate request is just a vessel for the requester public key, and his intended name, and any kind of information which the CA is free to replicate, or not, in the issued certificate. There is no theoretical problem in having several certificates, even from distinct CA, which all contain your name and your public key; actually, any CA could issue such a certificate without needing any interaction with you. They could all use the same certificate request. In practice, it would require some changes, because existing CA issue certificates as part of Web-based scenarios, where the buyer's browser is instructed to generate a new key pair, and send the public part to the CA without any interaction with the human buyer. Since the idea of having each server own at least 3 certificates basically triples the market of server certificates, I am quite sure that commercial CA would be willing to implement the relevant tweaks to their platform.

On the soundness of the idea: requesting multiple validation is a sound idea (the OpenPGP format already does it, mostly to deal with the inherent unreliability of a web-of-trust CA) but it may backfire: if having a single rogue or compromised CA does not impact general security, chances are that the next Comodo-like event will receive less publicity, possibly none at all. Multiple validation tends to encourage general leniency and loss of responsibility.

On Convergence: what the slashdot quote talks about is Convergence. This is a new system trying to get a foothold. See this answer for some details and pointers on the protocol.


I actually think this would be a really good idea. But it would require a new version of SSL and TLS to support. Currently everything is designed with the assumption that there is exactly one trust anchor. Which means it will probably never happen. I still have arguments with people who claim we "need" to support Windows 98.