Remix.run Logo
▲ wnoise 3 hours ago

Yeah, that's one of the complications. It would have to be ignored in processing, or multiple variants be presented at once (preferred).

Certificates are not the same as the public key; multiple certs sharing the same key is essentially the way around this. It's not as elegant as identical signing of the same cert, but it could work.

▲crote 3 hours ago | parent [-]

Identical signing of the same cert also runs into issues like "who gets to decide the serial number" and "how to deal with revocation lists: all of, or any of?".

And turning fields like issuer and serial into arrays risks someone accidentally using index 0 for one field and index 1 for another.

Combine that with the insane back-and-forth nightmare that the issuance process would turn into, and I have a very hard time seeing the benefit in it. After all, nobody is stopping you from requesting multiple certs independently, watching the revocation logs, and switching to the backup when required.