| ▲ | wnoise 3 hours ago | |
Yeah, that's one of the complications. It would have to be ignored in processing, or multiple variants be presented at once (preferred). Certificates are not the same as the public key; multiple certs sharing the same key is essentially the way around this. It's not as elegant as identical signing of the same cert, but it could work. | ||
| ▲ | crote 3 hours ago | parent [-] | |
Identical signing of the same cert also runs into issues like "who gets to decide the serial number" and "how to deal with revocation lists: all of, or any of?". And turning fields like issuer and serial into arrays risks someone accidentally using index 0 for one field and index 1 for another. Combine that with the insane back-and-forth nightmare that the issuance process would turn into, and I have a very hard time seeing the benefit in it. After all, nobody is stopping you from requesting multiple certs independently, watching the revocation logs, and switching to the backup when required. | ||