2

I understand the following:

  • An end-entity certificate is installed on the server and a new one needs to be installed by the webmaster when it expires
  • A root certificate is installed on the computer and a new one will likely come in an OS update for when it expires
  • A intermediate certificate is installed on the server, but what happens when it expires, does the webmaster need to get a new one of these too?

I need to know how an immediate certificate gets updated, does the webmaster get sent a new one to upload to the server with its normal end-entity certificates?

Improve this question
1
  • Your question seems to be more about web admin than about the security end of things.
    – schroeder ♦
    Dec 31, 2017 at 9:41

1 Answer 1

Reset to default
2

Validation of the end certificate would fail. However, intermediate certificates are typically valid for a much longer period of time than regular certificate, often 10 years. This enables the maintainers of the intermediate certificates to introduce a new intermediate certificate way before the old one expires, but after all end certificates expire, so in practice this situation shouldn't occur.

Improve this answer
4
  • Okay, this makes sense, but is it the webmaster who has to replace it?
    – Wub
    Dec 31, 2017 at 8:50
  • 1
    The webmaster would receive a newer intermediate certificate when he installs or renews an end certificate.
    – Teun Vink
    Dec 31, 2017 at 11:42
  • @TeunVink I'd like to add more to this question if anyone can answer referencing me to enhance the value of this question. As a person who created the self signed ca and intermediates, lets say 5 yrs down the line If I have to replace the Intermediate cert, how do I do it on my app servers? Do I need to append the new intermediate to the already existing ca bundle containing the rootca and old intermediate or should I simply replace the old intermediate from bundle. And after doing this will the bundle with new intermediate work for existing node certs or do I need to renew them as well ?
    – Aditya Pednekar
    Feb 9, 2021 at 12:55
  • @AdityaPednekar If you have additional questions, please post a new question here.
    – Teun Vink
    Feb 9, 2021 at 13:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.