Skip to main content
put the link on the text to improve readability
Source Link
TildalWave
  • 10.8k
  • 11
  • 47
  • 87

When a Root CA signs a certificate for an intermediate CA, the signed certificate has a special field set (specifically, a certificate authority flag in the Basic Constraints extension: http://unitstep.net/blog/2009/03/16/using-the-basic-constraints-extension-in-x509-v3-certificates-for-intermediate-cas/a certificate authority flag in the Basic Constraints extension), that designates it as a CA certificate. CertificatesCertificates signed for domains, as you'd get from your CA, do not have this field set, so your browser will not consider them for the chain of trusted certificates back to the root CA.

When a Root CA signs a certificate for an intermediate CA, the signed certificate has a special field set (specifically, a certificate authority flag in the Basic Constraints extension: http://unitstep.net/blog/2009/03/16/using-the-basic-constraints-extension-in-x509-v3-certificates-for-intermediate-cas/) that designates it as a CA certificate. Certificates signed for domains, as you'd get from your CA, do not have this field set, so your browser will not consider them for the chain of trusted certificates back to the root CA.

When a Root CA signs a certificate for an intermediate CA, the signed certificate has a special field set (specifically, a certificate authority flag in the Basic Constraints extension), that designates it as a CA certificate. Certificates signed for domains, as you'd get from your CA, do not have this field set, so your browser will not consider them for the chain of trusted certificates back to the root CA.

Source Link
David
  • 16.1k
  • 3
  • 52
  • 74

When a Root CA signs a certificate for an intermediate CA, the signed certificate has a special field set (specifically, a certificate authority flag in the Basic Constraints extension: http://unitstep.net/blog/2009/03/16/using-the-basic-constraints-extension-in-x509-v3-certificates-for-intermediate-cas/) that designates it as a CA certificate. Certificates signed for domains, as you'd get from your CA, do not have this field set, so your browser will not consider them for the chain of trusted certificates back to the root CA.