<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hi everyone,</p>
<p>I am trying to cross-sign a third party certificate which is
*not* self signed (e.g. a third party intermediate CA, or even a
particular client certificate) like this:<br>
<br>
<i>openssl x509 -in third-party.crt -CA /etc/pki/r1/ca.crt -CAkey
/etc/pki/r1/private/ca.key -out third-party-cross-signed.crt
-set_serial 1000</i><br>
</p>
<p>This results in the following error: <i>Error with certificate
to be certified - should be self-signed</i><i><br>
</i><br>
The same thing works for signing third-party root CAs (as they are
self-signed), but that might be too broad in some situations.<br>
<br>
Could anybody explain the reason for this restriction?<br>
<br>
Best regards<br>
Yannik<br>
</p>
</body>
</html>