1

I have an intermediate and a root PKI certificate that I see were already imported into a computers (windows server 2003) certificate store. However both the intermediate and root certificates were placed in the 'Trusted Root Certification Authorities' certificates folder. PKI Certificates

That is obviously the appropriate place for the root certificate but not the intermediate certificate. Other then being in the wrong place aesthetically, will having the intermediate certificate in the 'wrong' folder cause failures or technical problems? In otherwords, are the folder locations just for organization, or do they affect functionality of the PKI certificates?

Improve this question
1
  • I've never fully understood the security implications of storing certs in different folders, though there are cases I've seen it matter (XBAP in Trusted Publishers for example)
    – makerofthings7
    Aug 13, 2014 at 21:11

2 Answers 2

Reset to default
3

If you put the intermediate CA certificate in the "trusted root" store, then you are instructing your machine to actually trust that certificate ex nihilo. You have turned it into a trusted root. When, for instance, your Web browser tries to validate a certificate issued by that "intermediate" CA, it will accept it with a chain which begins with that CA, totally ignoring the true root CA.

The basic consequence is that the intermediate CA can no longer be revoked: since your machine trusts that certificate by virtue of it being in the "trusted roots" store, and not by virtue of it being signed by another trusted certificate, then it has no reason whatsoever to download a CRL which covers it. By definition, trusted roots are not revoked; they are installed manually, and if they are no longer to be trusted, then they are removed manually as well.

Thus, emplacement matters. Certificates in the "trusted root" store are meant to be managed explicitly, so you should put there only the CA certificates that you intend to manage explicitly. "Explicit management" here means "when the certificate must not be trusted anymore, the sysadmin must manually remove the certificate from the store".

Improve this answer
0

I don't agree with the above answer by Tom - perhaps the behaviour could depend based on different products where it's hosted. I had done the same in IIS 6 many years ago; I've had TWO intermediate CA certificates (primary and secondary) and one root CA certificate. I placed all of them in the root CA store. During certificate authentication, the behaviour was for the system to first evaluate the secondary intermediate cert, then the primary intermediate cert and then the Root certificate. Both the primary and the ROOT certificates presence mattered and the location did not make any difference. I did move the intermediates back to the correct location though.

Therefore emplacement does not matter in this scenario, however I'm not sure if the behaviour could vary among different products.

You can verify which one is correct by deleting the root certificate from the list and see if your certificate authentication is successful.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .