14

I've been trying to learn more about Digital certificates for the past few days and I'm struggling in order to understand how actually this concept is applied in the real world.

Anyways, as I visited the website https://google.com, I decided to view the site information and I came across this information called Certification Path. This is what it looked like:

enter image description here

The question that I actually wanted to ask is what exactly is this Certification Path? Does it show the certificates hierarchy?

What I understood:

  • GeoTrust Global CA is the Root CA here.
  • Google Internet Authority G2 is the Intermediate CA and it's certificate is signed by the Root CA.
  • Hence, Google Inc. here acts as a CA and is using a Self Signed Certificate here.

Can someone please explain what actually is going on here? Also, feel free to provide any references or good readings related to this concept.

Improve this question

1 Answer 1

Reset to default
18

This screen is displaying the Chain of Trust. This is a list of who is offering signed proof that the key is valid as promised.

  • www.google.com's certificate (at the bottom of the chain) is signed by "Google Internet Authority G2". This is called a working certificate, or the end-entity certificate. It has a key usage flag that states the key in it can be used for "key encipherment" (meaning securing an SSL connection) and a flag that says it can not be trusted to sign keys. Furthermore, this certificate can only be trusted for connections to www.google.com, as stated in the CN value of the subject.

  • The Google Internet Authority G2 certificate is signed by GeoTrust Global CA. Google Internet Authority G2 is a Subordinate Certificate Authority (SCA). It has key usage flags that state the key can be used to sign other certificates, but not to encipher keys. SCAs are also known as issuing certificates. They exist so that a large organization can sign the many certificates they need to operate. Google likely has hundreds of thousands of certificates in use.

  • GeoTrust Global CA's certificate is signed only by itself. That makes it a root certificate, and at this point you can say they are a Certificate Authority (CA). However, your browser doesn't fully trust every self signed certificate it sees, because anyone can create a self-signed certificate, and could place their phony self-signed root certificate on a fake site and spoof you into believing the site is legitimate. Instead, you'll find that GeoTrust is an organization called a Public Certificate Authority. Public CA certificates are those that are placed in your certificate store by the OS vendor or by the browser vendor. These are organizations that are implicitly trusted only to sign valid certificates. They undergo annual audits and are subject to a lot of rules to ensure they only issue certificates to the legitimate site owners. The responsibility for maintaining this list of trustworthy CAs is the job of the CA/Browser Forum.

You can look in Wikipedia for Public Key Infrastructure (PKI) to get more of an idea how certificates are related and used.

Improve this answer
2
  • If the EE cert contains SubjectAltName (SAN) extension -- and google's did at least back to 2015, like practically all public-CA certs since the early '10s -- it is trusted for any server whose name (or possibly but rarely address) matches an entry in SAN. For google specifically SAN is nowadays (2019) about 50 entries, many of them wildcards that match multiple server names.
    – dave_thompson_085
    Mar 12, 2019 at 5:00
  • @dave_thompson_085 , I debated with myself on adding a discussion of SAN in here. But SAN has weird historical exceptions, so I finally decided I didn’t want to add too many details to this overview-level answer. I figure if I headed down that path, I’d end up with half the X.509 spec in here. And an answer that size would help no one.
    – John Deters
    Mar 12, 2019 at 16:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .