Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

The following MSFT document has this paragraph:

  1. All possible certificate chains are built using locally cached certificates. If none of the certificate chains ends in a self-signed certificate, CryptoAPI then selects the best possible chain and attempt to retrieve issuer certificates specified in the authority information access extension to complete the chain. This process is repeated until a chain to a self-signed certificate is built.

  2. For each chain that ends in a self-signed certificate in the trusted root store, revocation checking is performed.

Does this imply that a single certificate can have multiple "chains". What would this look like, and where would it be used?

share|improve this question
add comment

1 Answer

up vote 4 down vote accepted

Multiple roots are created when

This applies to every certificate in the CA hierarchy.

Just to make things more interesting, the revocation list itself (CRL/OCSP) is signed and may have it's own PKI. They may also have their own set of keys. (To verify the verifier?)

In other words,

  • The chains discovered while verifying the CRL, Deltas, and OCSP responses also count towards a CA root that is discovered. (note that OCSP verification can be suppressed via id-pkix-ocsp-nocheck )

The CA architecture has an effect on the chain-building process. Before a distinct certificate chain is considered valid, the chaining engine builds all chains that are possible with the certificate that is being verified. If an end-entity certificate was generated by a freshly set up CA, the certificate chain is straightforward. However, a certificate that was issued by a renewed CA or where a cross-certification exists between the issuing CA and another CA, multiple certificate chains might exist.

The entire graph of certificate chains is constructed and then ordered by the “quality” of the chain. The best quality chain for a given end certificate is returned to the calling application as the default chain.

Below are illustrations of validation processes in a Single, N-Tier, Cross, and Bridge PKI

Single CA

Single CA

N Tier

N-Tier

Cross Trust CA

Cross CA

Bridge CA

Bridge CA

More information on PKI topology and cert renewals is at the bottom of this article

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.