Why are intermediate certificate authorities required? When would an intermediate certificate be used? How do I verify the chain from the intermediate certificate to the root certificate? What are examples of intermediate certificates that link to root certificates?
closed as not constructive by Ƭᴇcʜιᴇ007, David, Mokubai♦, Linker3000, studiohack♦ Nov 6 '11 at 3:28
As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance. If this question can be reworded to fit the rules in the help center, please edit the question.
Sometimes, to protect the root CA's private key, it is stored in a very secure location and only used to sign a few intermediate certificates, which then are used to issue end entity certificates. In case of compromise, the intermediates can be revoked quickly, without having to reconfigure every single machine to trust a new CA.
Another possible reason is delegation: for example, such companies as Google, which often use many certificates for their own networks, will have an intermediate CA of their own.
Usually, the end entity (for example, a SSL/TLS web server) provides you with the entire certificate chain, and all you have to do is verify the signatures.
The last in that chain is the root certificate, which you already have marked as trusted.
For example, when you have a chain [user] → [intermed-1] → [intermed-2] → [root], the verification is like this:
The process is exactly the same all the time; the existence and count of intermediate CAs does not matter. The user certificate can be signed by root directly, and it will be verified the same way.
See the certificate information of https://twitter.com/ or https://www.facebook.com/ for chains containing three or four certificates. See also https://www.google.com/ for an example of Google's own certification authority.