Question

A financial services company operates a private PKI with an offline root CA. To enable trust for a newly acquired subsidiary that already deployed thousands of endpoints trusting a different existing root, the security engineer must allow certificates issued by the company's intermediate CA to validate on the subsidiary's endpoints WITHOUT redeploying a new root to those endpoints or replacing existing leaf certificates. Which approach best achieves this?

Accepted Answer

Cross-sign the company's intermediate CA with the subsidiary's existing trusted root, so chains can build a path to a root the endpoints already trust

Answer

Distribute the company's offline root CA certificate to all subsidiary endpoints via a mass push and add it to their trust stores

Answer

Reissue every leaf certificate from the subsidiary's existing intermediate CA and revoke the originals

Answer

Configure the company's intermediate CA as a self-signed root and install it only on the company's own servers