A cross-sign is a certificate issued by one certificate authority (CA) that vouches for another CA or its certificate. It can let a certificate hierarchy chain to a root that a device or application already trusts, extending compatibility across different trust stores.
Cross-signing matters because a certificate’s acceptance depends on the chain of trust that can be built and validated. Attackers who obtain or misuse a CA’s signing capability may exploit trusted chains, while defenders assess the certificates and roots involved, update trust lists when necessary, and check that affected systems receive those changes. A cross-sign’s presence does not itself prove abuse, but its issuing CA and chain are important when evaluating certificate risk.