Cross-signing occurs when one certificate authority signs another CA’s certificate, allowing clients to build an alternate path from that CA to a trusted root. The certificate can therefore be trusted through more than one chain, depending on which roots a device or application recognizes.
This can improve compatibility during CA transitions, but it complicates security response. If a CA key is compromised or a certificate must be distrusted, defenders need to consider every valid path, not just one chain. Attackers with a compromised signing key may try to issue certificates that appear valid along a path a client still trusts. Browser and platform trust-store updates help block affected paths, while CA operators should track cross-signed certificates and verify that revocation and distrust reach relevant clients.