Scenario 1.2: Create Intermediate CA

This scenario describes the creation of an Intermediate CA (also called Sub-CA or Issuing CA), which is signed by the Root CA. The Intermediate CA issues end-entity certificates and protects the Root CA key, which can remain offline.

What is created:

• ML-DSA-65 key pair for Intermediate CA
• Certificate Signing Request (CSR)
• Intermediate certificate signed by Root CA
• Encrypted private key

Advantages of an Intermediate CA:

• Security: Root CA stays offline, only Intermediate CA online
• Flexibility: Multiple Intermediate CAs for different purposes (Server, Client, Code Signing)
• Revocation: Intermediate CA can be revoked without compromising Root
• Compliance: Follows best practices (CA/Browser Forum, BSI)

Typical Intermediate CA Types:

• Server CA: For TLS server certificates
• Client CA: For mTLS client certificates
• User CA: For email/S-MIME certificates
• CodeSign CA: For code signing certificates
• Device CA: For IoT/device certificates

┌─────────────────────────────────────────────────────────────────────────┐
│                    INTERMEDIATE CA CREATION                              │
│                                                                         │
│   ┌─────────────────────────┐       ┌─────────────────────────┐        │
│   │   INTERMEDIATE CA       │       │      ROOT CA            │        │
│   │   (Online System)       │       │   (Air-Gapped System)   │        │
│   └─────────────────────────┘       └─────────────────────────┘        │
└─────────────────────────────────────────────────────────────────────────┘

     ┌──────────────┐
     │ 1. Init      │
     └──────┬───────┘
            │
            ▼
     ┌──────────────┐
     │ 2. KeyPair   │ ──────► ML-DSA-65 for Intermediate
     │ generate     │
     └──────┬───────┘
            │
            ▼
     ┌──────────────┐
     │ 3. DN        │ ──────► CN=WvdS Server CA
     │ create       │         O=DATECpro GmbH
     └──────┬───────┘
            │
            ▼
     ┌──────────────┐
     │ 4. Extensions│ ──────► BasicConstraints, KeyUsage, EKU
     │ for CSR      │         (requested extensions)
     └──────┬───────┘
            │
            ▼
     ┌──────────────┐
     │ 5. CSR       │ ──────► PKCS#10 Request
     │ create       │         Signed with Intermediate key
     └──────┬───────┘
            │
            │  ══════════════════════════════════════════
            │  CSR Transfer (USB stick, secure channel)
            ▼  ══════════════════════════════════════════

     ┌──────────────┐
     │ 6. Root CA   │ ──────► Load root-ca.key.pem
     │ load         │         (Air-Gapped System)
     └──────┬───────┘
            │
            ▼
     ┌──────────────┐
     │ 7. CSR       │ ──────► Verify: DN, signature, extensions
     │ validate     │
     └──────┬───────┘
            │
            ▼
     ┌──────────────┐
     │ 8. Extensions│ ──────► BC, KU, SKI, AKI, CDP, AIA
     │ set          │         (CA determines final extensions)
     └──────┬───────┘
            │
            ▼
     ┌──────────────┐
     │ 9. Certificate│ ──────► Root CA signs
     │ issue        │         Intermediate certificate
     └──────┬───────┘
            │
            │  ══════════════════════════════════════════
            │  Certificate transfer back
            ▼  ══════════════════════════════════════════

     ┌──────────────┐
     │ 10. Save     │ ──────► intermediate-ca.crt.pem
     │              │         intermediate-ca.key.pem
     └──────┬───────┘
            │
            ▼
     ┌──────────────┐
     │ 11. Chain    │ ──────► Create ca-chain.pem
     │ create       │         (Intermediate + Root)
     └──────┬───────┘
            │
            ▼
     ┌──────────────┐
     │ 12. Cleanup  │
     └──────────────┘

using System;
using System.IO;
using WvdS.Security.Cryptography.X509Certificates.Extensions.PQ;
 
namespace IntermediateCaExample
{
    class Program
    {
        // Passwords (in production: enter securely!)
        const string ROOT_KEY_PASSWORD = "MyStr0ng!RootCA#Password2024";
        const string INTERMEDIATE_KEY_PASSWORD = "MyStr0ng!IntermediateCA#2024";
 
        static void Main(string[] args)
        {
            // === PHASE 1: Create CSR (Intermediate CA System) ===
            Console.WriteLine("=== PHASE 1: CSR Creation ===\n");
 
            using var context = PqCryptoContext.Initialize();
 
            // 1. Generate key pair for Intermediate CA
            Console.WriteLine("Generating ML-DSA-65 key pair for Intermediate CA...");
            using var intermediateKeyPair = context.GenerateKeyPair(PqAlgorithm.MlDsa65);
            intermediateKeyPair.SelfTest();
 
            // 2. Distinguished Name
            var intermediateDn = new DistinguishedNameBuilder()
                .AddCommonName("WvdS Server CA")
                .AddOrganization("DATECpro GmbH")
                .AddOrganizationalUnit("PKI Services")
                .AddCountry("DE")
                .Build();
 
            Console.WriteLine($"Intermediate DN: {intermediateDn}");
 
            // 3. Requested extensions for CSR
            var csrExtensions = new X509ExtensionsBuilder()
                .AddBasicConstraints(isCa: true, pathLengthConstraint: 0, critical: true)
                .AddKeyUsage(KeyUsageFlags.KeyCertSign | KeyUsageFlags.CrlSign, critical: true)
                .Build();
 
            // 4. Create and sign CSR
            Console.WriteLine("Creating Certificate Signing Request...");
            using var csr = context.CreateCertificateRequest(
                subject: intermediateDn,
                keyPair: intermediateKeyPair,
                extensions: csrExtensions
            );
 
            // 5. Save CSR as PEM
            string csrPem = csr.ExportToPem();
            File.WriteAllText("intermediate-ca.csr.pem", csrPem);
            Console.WriteLine("CSR saved: intermediate-ca.csr.pem");
 
            // 6. Save intermediate private key encrypted
            File.WriteAllText("intermediate-ca.key.pem",
                intermediateKeyPair.ExportToEncryptedPem(INTERMEDIATE_KEY_PASSWORD));
            Console.WriteLine("Private key saved: intermediate-ca.key.pem\n");
 
            // === PHASE 2: Issue certificate (Root CA System) ===
            Console.WriteLine("=== PHASE 2: Certificate Issuance by Root CA ===\n");
 
            // 7. Load Root CA materials
            Console.WriteLine("Loading Root CA...");
            using var rootCert = context.LoadCertificateFromPem(
                File.ReadAllText("root-ca.crt.pem")
            );
            using var rootKeyPair = context.LoadKeyPairFromEncryptedPem(
                File.ReadAllText("root-ca.key.pem"),
                ROOT_KEY_PASSWORD
            );
 
            Console.WriteLine($"Root CA loaded: {rootCert.Subject}");
 
            // 8. Load and validate CSR
            Console.WriteLine("Loading and validating CSR...");
            using var loadedCsr = context.LoadCertificateRequestFromPem(csrPem);
 
            if (!loadedCsr.VerifySignature())
                throw new CryptographicException("CSR signature invalid!");
            Console.WriteLine("CSR signature: OK");
 
            // 9. Extensions for intermediate certificate (CA determines)
            var certExtensions = new X509ExtensionsBuilder()
                // BasicConstraints: CA, but no further Sub-CA allowed
                .AddBasicConstraints(isCa: true, pathLengthConstraint: 0, critical: true)
                // KeyUsage: Certificate and CRL signing
                .AddKeyUsage(KeyUsageFlags.KeyCertSign | KeyUsageFlags.CrlSign, critical: true)
                // Subject Key Identifier (from CSR public key)
                .AddSubjectKeyIdentifier(loadedCsr.PublicKey)
                // Authority Key Identifier (= Root CA SKI)
                .AddAuthorityKeyIdentifier(rootCert)
                // CRL Distribution Point
                .AddCrlDistributionPoint("http://crl.datecpro.de/root-ca.crl")
                // Authority Info Access (OCSP + CA Issuers)
                .AddAuthorityInfoAccess(
                    ocspUri: "http://ocsp.datecpro.de",
                    caIssuersUri: "http://ca.datecpro.de/root-ca.crt"
                )
                .Build();
 
            // 10. Validity: 10 years (shorter than Root CA)
            var validity = new CertificateValidity(
                notBefore: DateTime.UtcNow,
                notAfter: DateTime.UtcNow.AddYears(10)
            );
 
            // 11. Issue Intermediate CA certificate
            Console.WriteLine("Issuing Intermediate CA certificate...");
            using var intermediateCert = context.IssueCertificateFromRequest(
                request: loadedCsr,
                issuerCertificate: rootCert,
                issuerKeyPair: rootKeyPair,
                validity: validity,
                extensions: certExtensions
            );
 
            // 12. Output certificate information
            Console.WriteLine("\n=== INTERMEDIATE CA CERTIFICATE ===");
            Console.WriteLine($"Subject:      {intermediateCert.Subject}");
            Console.WriteLine($"Issuer:       {intermediateCert.Issuer}");
            Console.WriteLine($"Serial:       {intermediateCert.SerialNumber}");
            Console.WriteLine($"Not Before:   {intermediateCert.NotBefore:yyyy-MM-dd}");
            Console.WriteLine($"Not After:    {intermediateCert.NotAfter:yyyy-MM-dd}");
            Console.WriteLine($"Algorithm:    {intermediateCert.SignatureAlgorithm}");
            Console.WriteLine($"Is CA:        {intermediateCert.IsCertificateAuthority}");
            Console.WriteLine($"Path Length:  {intermediateCert.PathLengthConstraint}");
            Console.WriteLine($"Thumbprint:   {intermediateCert.Thumbprint}");
 
            // 13. Save certificate
            File.WriteAllText("intermediate-ca.crt.pem", intermediateCert.ExportToPem());
            Console.WriteLine("\nCertificate saved: intermediate-ca.crt.pem");
 
            // === PHASE 3: Create chain ===
            Console.WriteLine("\n=== PHASE 3: Certificate Chain ===\n");
 
            // 14. Create CA chain (Intermediate + Root)
            using var chain = context.CreateCertificateChain();
            chain.Add(intermediateCert);
            chain.Add(rootCert);
 
            File.WriteAllText("ca-chain.pem", chain.ExportToPem());
            Console.WriteLine("CA chain saved: ca-chain.pem");
 
            // 15. Validation
            Console.WriteLine("\n=== VALIDATION ===");
 
            // Verify signature (Intermediate signed by Root?)
            bool signatureValid = intermediateCert.VerifySignature(rootCert);
            Console.WriteLine($"Signature by Root CA: {(signatureValid ? "OK" : "ERROR")}");
 
            // Chain validation
            using var trustStore = context.CreateTrustStore();
            trustStore.AddCertificate(rootCert);
 
            var validationResult = context.ValidateChain(chain, trustStore);
            Console.WriteLine($"Chain validation:     {(validationResult.IsValid ? "OK" : "ERROR")}");
 
            Console.WriteLine("\n✓ Intermediate CA successfully created!");
        }
    }
}

• Module: csr
• Module: cert
• Module: ext
• Module: chain
• Concept: PKI Fundamentals
• Concept: X.509 Extensions
• RFC 5280: X.509 PKI
• CA/Browser Forum: Baseline Requirements

« ← 1.1 Root CA | ▲ PKI Infrastructure | 1.3 CA Hierarchy → »

Wolfgang van der Stille @ EMSR DATA d.o.o. - Post-Quantum Cryptography Professional