Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Say an X.509 cert is signed by an intermediate cert that's not in your browser. Maybe the root certificate is but not the intermediate cert. At that point it seems like a valid certification path could exist even if your browser doesn't know about it and I guess you'd just be S.O.L?

Seems like maybe there ought to be an extension saying where the issuer cert can be obtained (assuming it's not the root cert) just as how there exist extensions for certificate revocation lists saying where those can be obtained.

share|improve this question
up vote 7 down vote accepted

It is the server's responsibility to serve up the entire certification chain. If your web server isn't doing that, it is misconfigured, and you should fix it.

You can use the SSL test service from SSL Labs to test whether your server has SSL properly configured. Just type in your server's domain name, and it will give you a report indicating whether it has any configuration issues. You can also use GlobeSSL's SSL tester, if you want a second opinion, though I think SSL Labs' service is more comprehensive.

share|improve this answer
So say I'm viewing a website's certification path / certificate hierarchy in Google Chrome or Firefox. How do I know if the intermediate certs are coming from the website or from the browser? – compcert Mar 19 '12 at 7:56
@compcert why does that matter? The way the PKI works, it doesnt matter where in the chain the cert is trusted, as long as there is some point where you can trust a root cert. – AviD Mar 19 '12 at 8:03
I want to test out SSL handshaking on a server that sends multiple X.509 certs instead of just one. I'm going through the X.509 RFC's right now and fully intend to read the SSL/TLS RFC's but in lieu of that I'd still like to be able to test stuff out.. – compcert Mar 19 '12 at 13:57
@compcert, if you are interested in viewing this for debugging purposes, have you considered trying Wireshark? I think it has built-in support for decoding the SSL protocol, but you could take a look and see for sure. – D.W. Mar 19 '12 at 17:46
I have, but Wireshark isn't quite as convenient. At the moment I'm not too interested in SSL handshaking involving just a single X.509 cert. It'd be nice to be able to go "oh, is this website sending multiple certs?" whenever I think of it. Wireshark just isn't as convenient. – compcert Mar 19 '12 at 19:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.