I read this, but it doesn't say if the public keys of the root and intermediaries are inside.


1 Answer 1


No, an X.509 certificate does not contain other public keys. And the keys alone wouldn't be very useful, anyway. In order for a client to verify a certificate, it needs the complete certificates of all intermediate CAs, not just the public keys. So web servers typically provide an entire chain of certificates.

The certificate of the root CA is not provided, because it must already be in the client's trust store as a trust anchor.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .