Now I have a self-signed root CA certificate whose signature algorithm is sha256WithRSAEncryption. All intermediate CA certificates issued by this root CA have the same signature algorithm which is sha256WithRSAEncryption. Is it possible to issue an intermediate CA certificate whose signature algorithm is ecdsa-with-SHA256 without changing the root CA? I can't find such a way, please give me some advice. It would be better if you could provide me with some reference documents about it. Thank you in advance.
I did some tests and found, the encryption algorithm of the private key will affect the signature algorithm of the root certificate. For example:
If I use this command openssl genrsa -out private/rootca.rsa2048.key.pem 2048 to generate a private key, the signature algorithm of the newly signed root CA is sha256WithRSAEncryption.
If I use this command openssl ecparam -genkey -name prime256v1 -noout -out private/interca.ecdsa256.key.pem to generate a private key, the signature algorithm of the newly signed root CA is ecdsa-with-SHA256.
It seems it's impossible to use a root CA whose signature algorithm is RSA to issue an intermediate CA whose signature algorithm is ECDSA. Please correct me if I'm wrong.
By the way, here is the description I found in IBM documents. It seems it's impossible indeed. https://www.ibm.com/docs/en/zos/2.5.0?topic=customization-updating-signature-algorithm#:~:text=The%20signature%20algorithm%20that%20PKI%20Services%20uses%20to%20sign%20certificates%20must%20be%20based%20on%20the%20key%20type%20of%20the%20CA%20certificate.
The signature algorithm that PKI Services uses to sign certificates must be based on the key type of the CA certificate.