2

In the answer to question "How TLS certificate chain is verified" it mentions that the involved intermediate certificates are "fetched and validated". How exactly is that done?

Specifically:

  • So I know the intermediate certificates can be stored locally at a client or served by the server. Are these two sources trusted the same? Do you have to fetch the intermediate from a server that is owned and operated by root CA or signing CA?

  • When a intermediate certificate is verified, does the client connect to the domain of the intermediate certificate owner to validate the certificate against the live domain? Or would a local-only algorithm do all the work up till the root certificate?

Improve this question
3

The system that is verifying the certificate chain has a local store of root CA certificates. The private keys associated with these certificates are used to sign intermediate certificates. The private keys for the intermediaries are then used in turn to sign certificates that are issued to servers. When obtaining the certificate chain from a server (the full chain can be requested from a properly configured service) this chain is walked, verifying signatures up the chain, all the way to a root CA that is in the systems local store.

If an intermediary cert was forged then the signature from the root CA that signed it (contained in the intermediary cert) would be invalid and the chain would be broken.

Improve this answer
2
  • Basically, the algorithm is all local, no need to connect to any of the signing agencies. Wherever the intermediaries are fetched from are all trusted the same. – minghua Apr 9 '17 at 3:10
  • This response is partially correct. Proper validation should check CRLs to ensure the intermediate CA certificate hasn't been revoked. This is perhaps the key difference (pun intended) between root and intermediate CA: Root CAs should be trusted while intermediate CAs should be validated using root issuer and CRL checks (in addition to expire, etc) – Andre de Miranda Apr 16 '20 at 3:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.