Does checking the certificate chain require connecting to external servers?
Not necessarily, if the chain is complete from a trusted CA to the leaf certificate (the site's certificate) then no requests are needed. Each cert is either trusted, or signed by a cert higher in the chain. For example.com this would look like this:
- Root CA (trusted as it is installed in the browser)
- Intermediate A (trusted as it is signed by Root CA)
- Intermediate B (trusted as it is signed by Intermediate A)
- Site cert (trusted as it is signed by Intermediate B)
Does checking revocation require connecting to external sources?
Using a CRL, or normal OCSP requires making an external request to check if the certificate has been invalidated since being issued, this can be a privacy issue as it allows a third party (the one running the OCSP responder) to track users.
To work around this issue, OCSP stapling can be used, where the server requests the OCSP response and returns it while it is valid to clients, before having to get a fresh response, preventing stale responses being used forever.
What happens when the chain is incomplete?
If the chain is incomplete then an
AIA Extention can be used to point to the issuer of a certificate, allowing the client to repair the gap in the chain, but client support for this is not ensured, so it is better to present a full chain when possible.