If I'm on a domain and I see that the cert tree is the following:

  • Root CA
  • Intermediate CA
  • Site Cert

But then if I implemented a domain wide policy to install a root cert in all browsers it would then look like: (Assuming this, I've never done it)

  • Domain Root CA
  • Root CA
  • Intermediate CA
  • Site Cert

Would it change the thumbprint//hash of the site cert?

Thank you.

  • 1
    It wouldn't look like that because you can't have more than one active root CA certificate in the chain. – Crypt32 Jan 25 '17 at 20:31

No, this would not change the hash of the site's certificate.

The thumbprint is part of the X.509 container that is essentially an immutable transaction log entry that you get to keep with you. It was signed by the CA when you submitted the certificate signing request (The intermediate it looks like.)

Adding another Certificate Authority to local machines cert stores would have no effect on that hash.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.