To this date, is there a specification or a de-facto industry standard or how applications are supposed to perform certification path building in the context of X.509? I am specifically asking about the part of the certification path building process that retrieves all the necessary certificates.

Certification path building is the process by which the certificate processing system obtains the certification path between a trust anchor and the target certificate. RFC 3280

1 is a 2005 informational RFC about the topic but it's not "Standard" nor "Best Current Practice".

Wikipedia mentions that, at least in the early days of 509 certs, a server would send all the required certificates:

[...] The problem is the client does not know where to fetch missing intermediate certificates because the global X.500 directory never materialized.[...] To work around the problem, web servers now send all the intermediate certificates along with the web server's certificate. Wikipedia

Moreover, from online sources, I gathered that applications (e.g. web broswers) are preconfigured with intermediate certificates.

Finally, I came across Authority Information Access (AIA) which seems to be a standard feature a client could use to retrieve missing intermediate certificates. But again, this fetures is not mandatory and I found examples of it sometimes being implemented, sometimes not. Medium article on AIA.

I listed 3 ways to perform Certification Path Building (receive the certs form the server, certs hardcoded in the applicaiton and AIA). But is there a standard?

  • For SSL/TLS including web (HTTPS) all standards (6101, 2246, 4346, 5246, 8446) require server send all intermediates and make it optional to send root. No browser I know of is configured with intermediates, so your 'sources' are wrong; browsers either are configured with roots (Firefox/Tor at least by default) or use an OS-provided store which is configured with roots (Chrome/Edge/Brave/Opera, Safari, IE before it vanished). But remember web&browsers are not the only use of SSL/TLS and SSL/TLS not the only use of X.509 certificates, and other uses are often different. Commented Oct 25, 2023 at 0:12
  • Thanks, your comment was helpful, I was looking for a standard in the 509 spec but I didn't consider to look for this in the TLS spec.
    – Nope
    Commented Oct 25, 2023 at 7:56
  • OP, @dave_thompson_085 is correct that browsers are not configured with intermediate certificates, per se. However, Firefox maintains a local cache of preloaded intermediate certificates, which it updates regularly. Not sure if other browsers do the same.
    – mti2935
    Commented Oct 25, 2023 at 11:54

1 Answer 1


Modern web browsers will use all three of the methods that you described to try to build a valid chain of trust up to a root certificate that it trusts. These multiple ways of validating certificates are what enable us to have cross-signed certificates.

Related: What could cause classic "ERR_CERT_DATE_INVALID" when I can confirm no error from numerous other clients?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .