Suppose I have CA1 root certificate and two intermediate CA2 and CA3 certificates issued by CA1. Would it pose any security issue if all of the intermediate certificates were installed in the root store? I'd like to know what's the purpose of this intermediate certificate store and when should I use it. I understand that it is created to store intermediate certificate authorities, but is there a reason why it was created specifically and why I can't keep all my certs in the root store?

certmgr

up vote 1 down vote accepted

Would it pose any security issue if all of the intermediate certificates were installed in the root store?

Yes. Root-CAs are a pain to revoke. That's why the intermediate-CA idea became popular some years ago. Intermediate CAs are much easier to revoke.

I'd like to know what's the purpose of this intermediate certificate store...

Speed. It's a cache that Windows uses.

...and when should I use it.

You don't. It's automatic.

It is entirely organizational. You may place your certificates wherever you want.

That said, the intermediate CA's play a role in IT infrastructure because they are able to issue certs, but can be limited to only issue for specific purposes. This allows an organization to use a separate ICA different functions (development, production, clients, ...)

The advantage of this is that the root CA can be used less and kept in a more secure situation, while the different functions can operate independently of each other and compromises of one ICA won't affect other functions.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.