Topic

SSL/TLS certificate chains

A certificate chain links a website certificate through one or more issuing certificate authorities to a trusted root recognized by the client.

At a glance

Leaf certificate
Identifies the site or service
Trust anchor
Root certificate already trusted by the client

Overview

TLS clients do not usually trust every website certificate directly. Instead, a website presents its certificate and usually the intermediate certificates needed to build a path toward a root certificate already trusted by the operating system or browser. Validation also checks names, dates, signatures, permitted uses, and other certificate constraints.

Intermediates connect the leaf to the root

Certificate authorities often keep root keys offline and issue intermediate certificates that sign site certificates. The server should provide the intermediates needed for clients to construct a valid path, while the trusted root itself is normally already present in the client trust store.

A chain is more than a list of certificates

Validation checks cryptographic signatures and policy constraints at each step. A certificate can therefore be correctly signed yet still fail because it is expired, names the wrong host, lacks the required usage, has been revoked, or cannot be connected to a trusted anchor.

Sources and review

MOOR's explanatory text is supported by the following source links.

  1. Internet X.509 Public Key Infrastructure Certificate and CRL Profile — RFC Editor
  2. What is a certificate chain? — DigiCert

Browse MOOR Knowledge