I understand the following:

  • An end-entity certificate is installed on the server and a new one needs to be installed by the webmaster when it expires
  • A root certificate is installed on the computer and a new one will likely come in an OS update for when it expires
  • A intermediate certificate is installed on the server, but what happens when it expires, does the webmaster need to get a new one of these too?

I need to know how an immediate certificate gets updated, does the webmaster get sent a new one to upload to the server with its normal end-entity certificates?

  • Your question seems to be more about web admin than about the security end of things.
    – schroeder
    Commented Dec 31, 2017 at 9:41

1 Answer 1


Validation of the end certificate would fail. However, intermediate certificates are typically valid for a much longer period of time than regular certificate, often 10 years. This enables the maintainers of the intermediate certificates to introduce a new intermediate certificate way before the old one expires, but after all end certificates expire, so in practice this situation shouldn't occur.

  • Okay, this makes sense, but is it the webmaster who has to replace it?
    – Wub
    Commented Dec 31, 2017 at 8:50
  • 1
    The webmaster would receive a newer intermediate certificate when he installs or renews an end certificate.
    – Teun Vink
    Commented Dec 31, 2017 at 11:42
  • @TeunVink I'd like to add more to this question if anyone can answer referencing me to enhance the value of this question. As a person who created the self signed ca and intermediates, lets say 5 yrs down the line If I have to replace the Intermediate cert, how do I do it on my app servers? Do I need to append the new intermediate to the already existing ca bundle containing the rootca and old intermediate or should I simply replace the old intermediate from bundle. And after doing this will the bundle with new intermediate work for existing node certs or do I need to renew them as well ? Commented Feb 9, 2021 at 12:55
  • @AdityaPednekar If you have additional questions, please post a new question here.
    – Teun Vink
    Commented Feb 9, 2021 at 13:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .