For example, assume stackoverflow.com used a certificate issued by Google who is trusted. In the stackoverflow.com certificate, its own public key would be stored. However, is it also possible for Google's public key to be stored in the same certificate belonging to stackoverflow.com?

  • Although not the same as storing the CA's public key in the leaf certificate - many web servers do send the entire certificate chain (not just the leaf certificate). See stackoverflow.com/questions/30344893/…
    – mti2935
    Nov 10, 2021 at 16:34
  • "Possible" is rarely the right choice for a question. There are all sorts of fields in an X.509 certificate where you can put anything you want and no software will complain. Stick it in the organizational unit (OU) field of the CN, put it in a custom extension, whatever. But what would be the point? Nov 10, 2021 at 21:15

1 Answer 1


Well, not exactly, but issuer's public key reference is included in the leaf certificate, in Authority Key Identifier (RFC 5280 §5.2.1) certificate extension. It contains the SHA1 hash of issuer's public key.

When certificate chaining engine (CCE) will build the chain and get multiple cached issuer certificates with different public keys, CCE will get the proper certificate by comparing AKI extension value with Subject Key Identifier (SKI) of issuer (they must match).

If SKI is absent in issuer certificate, a hash over issuer candidate's public key will be calculated on a fly.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .