Do CAs issue intermediate Certificate for each new certificate?
I am new to certificates and asking this to understand if the CAs have a ready set of intermediate certificates they use to issue leaf certificate or the its created based on the Certificate Request information provided by the requester?
Certificate that CA issue is a, simply said, confirmation that public key that you sent to CA in the Cerfiticate Request, really belongs to you (otherwise everyone could claim that he is the owner of domain google.com or amazon.com). Since the certificate contains your public key, it cannot be prepared in advance. Furthermore, response time depends on the type of certificate you requested. Simple certificates that confirm that the requester (you) really owns domain take little time to generate. Usually CA sends you a link to some email your domain, like [email protected]. You click on the link and confirm you are the owner. Then CA generates a certificate and sends it to you.
But other types of certificates include much more verification, e.g. CA needs to verify that your company really exists and is really properly registered, that your company resides at the particular address, etc. Such verification can take much longer, days or weeks. It takes much effort, so the price is correspondingly higher. But also the certificate confirms much more than other certificates.
Besides domain certificates there are other types of certificates, like S/MIME: To sign your emails, so the the receiver can rely that the email is really from you; also it can be user for Email encryption. Verification and generation of such certificates takes even less time than for domain certificates. There are certificates for code signing, etc.
More details you can find on the web sites of CAs (I prefer not to promote here any of them).
To signing certificates:
CA has a root certificate. It is the most important piece in the certificate hierarchy. That's why it is stored with much security. For practical often usage it is inconvenient. That's why CA uses root certificate (whose validity is usually 10 years or more) to issue some signing certificates that have shorter validity, like 3 - 5 years. Shorter validity means less exposure and thus less risks of compromising.
To the question: Yes, such signing certificates are created in advance.
No. When you submit a Certificate Signing Request to a CA, you've already selected which "intermediate" certificates are applicable.
If you send a CSR directly to a Root, there are no intermediates.
If you send a CSR to a Sub CA (signed by a Root), you're getting the CSR signed by an "intermediate" which was already set up.
When designing a certification authority hierarchy, you start with a Root, and then create a Subordinate CA (Sub-CA) signed by the Root, and then perhaps even a subordinate signed by that (Sub-Sub-CA) as well, depending on your requirements. If you ask for a certificate from the Sub-Sub-CA, you already know which certificates will be "intermediate" between the CSR and the Root.
