Do CAs issue intermediate Certificate for each new certificate?

I am new to certificates and asking this to understand if the CAs have a ready set of intermediate certificates they use to issue leaf certificate or the its created based on the Certificate Request information provided by the requester?

2 Answers 2


Certificate that CA issue is a, simply said, confirmation that public key that you sent to CA in the Cerfiticate Request, really belongs to you (otherwise everyone could claim that he is the owner of domain google.com or amazon.com). Since the certificate contains your public key, it cannot be prepared in advance. Furthermore, response time depends on the type of certificate you requested. Simple certificates that confirm that the requester (you) really owns domain take little time to generate. Usually CA sends you a link to some email your domain, like [email protected]. You click on the link and confirm you are the owner. Then CA generates a certificate and sends it to you.

But other types of certificates include much more verification, e.g. CA needs to verify that your company really exists and is really properly registered, that your company resides at the particular address, etc. Such verification can take much longer, days or weeks. It takes much effort, so the price is correspondingly higher. But also the certificate confirms much more than other certificates.

Besides domain certificates there are other types of certificates, like S/MIME: To sign your emails, so the the receiver can rely that the email is really from you; also it can be user for Email encryption. Verification and generation of such certificates takes even less time than for domain certificates. There are certificates for code signing, etc.

More details you can find on the web sites of CAs (I prefer not to promote here any of them).

To signing certificates:

CA has a root certificate. It is the most important piece in the certificate hierarchy. That's why it is stored with much security. For practical often usage it is inconvenient. That's why CA uses root certificate (whose validity is usually 10 years or more) to issue some signing certificates that have shorter validity, like 3 - 5 years. Shorter validity means less exposure and thus less risks of compromising.

To the question: Yes, such signing certificates are created in advance.

  • This is the leaf certificate but I am asking about the intermediate certificate used to sign the leaf one
    – Mo Haidar
    Feb 18, 2020 at 1:11
  • So you mean those signing certificates are not issued the time a new certificate request is posted. They are already existing and might be used to sign more than a certificate for different organizations, am I correct?
    – Mo Haidar
    Feb 18, 2020 at 1:22
  • Thanks a lot, please reflect these information to the main answer so ia can mark it as answered.
    – Mo Haidar
    Feb 18, 2020 at 1:28

No. When you submit a Certificate Signing Request to a CA, you've already selected which "intermediate" certificates are applicable.

If you send a CSR directly to a Root, there are no intermediates.

If you send a CSR to a Sub CA (signed by a Root), you're getting the CSR signed by an "intermediate" which was already set up.

When designing a certification authority hierarchy, you start with a Root, and then create a Subordinate CA (Sub-CA) signed by the Root, and then perhaps even a subordinate signed by that (Sub-Sub-CA) as well, depending on your requirements. If you ask for a certificate from the Sub-Sub-CA, you already know which certificates will be "intermediate" between the CSR and the Root.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .