up vote 1 down vote favorite
share [g+] share [fb]

Why are intermediate certificate authorities required? When would an intermediate certificate be used? How do I verify the chain from the intermediate certificate to the root certificate? What are examples of intermediate certificates that link to root certificates?

link|improve this question
91% accept rate
Would appreciate people commenting at the very least before voting to close the question. I have no idea why you would want to close it e.g. is it a duplicate, makes no sense, etc – PeanutsMonkey Oct 17 '11 at 22:11
1  
Voted to close as 'off topic' as I don't see any specific hardware or software problem. Is something broken - if so give specifics. If not, this is not a valid question as per the faq...."You should only ask practical, answerable questions based on actual problems that you face. Chatty, open-ended questions diminish the usefulness of our site and push other questions off the front page. " – Linker3000 Oct 17 '11 at 23:29
1  
@Linker3000 - The question is not open-ended as there is clearly an answer nor is it chatty i.e. it is not intended to stir up a conversation. It is to understand how SSL chains work so that if the need arises when implementing SSL certificates it can be done so with an understanding the foundations of SSL chains. – PeanutsMonkey Oct 18 '11 at 0:18
feedback

closed as not constructive by techie007, David, Mokubai, Linker3000, studiohack♦ Nov 6 '11 at 3:28

This question is not a good fit to our Q&A format. We expect answers to generally involve facts, references, or specific expertise; this question will likely solicit opinion, debate, arguments, polling, or extended discussion. See the FAQ for guidance on how to improve it.

1 Answer

up vote 9 down vote accepted

Why are intermediate certificate authorities required? When would an intermediate certificate be used?

Sometimes, to protect the root CA's private key, it is stored in a very secure location and only used to sign a few intermediate certificates, which then are used to issue end entity certificates. In case of compromise, the intermediates can be revoked quickly, without having to reconfigure every single machine to trust a new CA.

Another possible reason is delegation: for example, such companies as Google, which often use many certificates for their own networks, will have an intermediate CA of their own.

How do I verify the chain from the intermediate certificate to the root certificate?

Usually, the end entity (for example, a SSL/TLS web server) provides you with the entire certificate chain, and all you have to do is verify the signatures.

The last in that chain is the root certificate, which you already have marked as trusted.

For example, when you have a chain [user] → [intermed-1] → [intermed-2] → [root], the verification is like this:

  1. Does [user] have [intermed-1] as its "Issuer"?

  2. Does [user] have a valid signature by [intermed-1]'s key?

  3. Does [intermed-1] have [intermed-2] as its "Issuer"?

  4. Does [intermed-1] have a valid signature by [intermed-2]'s key?

  5. Does [intermed-2] have [root] as its "Issuer"?

  6. Does [intermed-2] have a valid signature by [root]'s key?

  7. Since [root] is at the bottom of the chain and has itself as "Issuer", is it marked as trusted?

The process is exactly the same all the time; the existence and count of intermediate CAs does not matter. The user certificate can be signed by root directly, and it will be verified the same way.

What are examples of intermediate certificates that link to root certificates?

See the certificate information of https://twitter.com/ or https://www.facebook.com/ for chains containing three or four certificates. See also https://www.google.com/ for an example of Google's own certification authority.

link|improve this answer
Thanks. When you say delegation, how does it help with having their own intermediate certificates? Does it also mean that it has been signed by another trusted root certificate authority? I had a look at Google's certificate however did not see the chain. Can you please upload an image of what you mean? – PeanutsMonkey Oct 17 '11 at 22:13
They're not signed by another trusted root certificate authority, they're signed by their trusted root certificate authority. Typical CAs have several different systems that can sign certificates. If they all actually used the root key, a compromise to one system would destroy the entire CA and render all of their certificates untrustable. – David Schwartz Oct 17 '11 at 22:27
@David Schwartz - Thanks. So in Google's case as an example their root certificate authority is Equifax that have provided them the ability to create intermediate certificates. Is that right? – PeanutsMonkey Oct 17 '11 at 22:41
2  
That is correct. Most likely, Equifax holds the key needed to sign certificates issued by that intermediate CA, but Google has an interface to allow them to sign certificates without human intervention on Equifax's part. If Google ever abuses the privilege, Equifax can use their root authority to revoke Google's intermediate CA authority. – David Schwartz Oct 17 '11 at 23:00
feedback

Not the answer you're looking for? Browse other questions tagged or ask your own question.