Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
We have set up a rootca and created a subca to sign certs. What should be deployed to /usr/local/share/ca-certificates/ to update the trusted CA stores? The certificate chain or just the RootCA cert? Most configuration files have a separate directive to point to the certificate chain so it appears that best practice is that only the rootca cert should be trusted?
The generic form of this question is whether the RootCA only should be trusted or the intermediate cert.
thanks
The path validation needs to end in a self-signed root certificate which means that it is not sufficient to trust the intermediate certificate only, i.e. trusting the root CA is required in any case.
If you additionally need to add the intermediate CA as trusted depends on the setup of your systems: Usually TLS peers provide not only the leaf certificate but also any chain certificates needed to verify the leaf certificate against the root CA. In this case you don't need to be explicitly add the intermediate CA as trusted since it is provided during the TLS handshake. Only in broken setups where this sub-CA is not provided in the TLS handshake it need to be otherwise known, i.e. added to the list of trusted certificates.
