I'm trying to learn a bit more about acting as my own CA. I've learned some of the basics so far. Create a root pair, keep your root key safe, private and use it to sign other things.

I'm now trying to learn about intermediate certificates. From what I've read these can act as the CA. So root signs intermediate, intermediate signs server/client certs establishing a chain of trust.

What I don't understand is how or why you would use/need 2 intermediate certificates. I've seen CAs do this where they provide a root cert, 2 intermediate certs and your server cert. How does that work? Why would you want 2?

And lastly, if I'm acting as my own CA how can I perform this? Am I creating 2 intermediate pairs, and if so which do I subsequently use to sign my client/server certs?

  • I did a little bit more searching, I may have the answer but I'd like to make sure it's correct. -Root signs itself and intermediate 'A' -intermediate 'A' signs intermediate 'B' -intermediate 'B' signs server/client certs Is this process more or less correct? – LJR135 Feb 8 '17 at 4:38
  • Yes. The basic idea is to delegate the signing process to other instances, see for example here: juniper.net/techpubs/images/g039005.gif – Hacktiker Feb 8 '17 at 7:43
  • In addition, new tier may appear in a result of cross-signing. Comodo has a long history of cross-certification. – Crypt32 Feb 9 '17 at 6:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.