I suppose this is related to What is an intermediate certificate authority? but I think my question is a bit different so I'll ask it anyway.

Why do most modern certificate authorities (e.g. VeriSign) require two intermediates? And if more than one is necessary for security purposes, why "just" two? Why not three? Or four?

2 Answers 2


I think it's more of a security concern as highlighted in 1.

CAs like VeriSign uses the two-tier hierarchy (or trust chain) concept to provide more security. This is because the roles of the primary and secondary CAs are separated and may be hosted in different servers, maybe in different geographical locations.

So, most probably more precautions are taken to safeguard the private keys of the primary CA than the other intermediate CAs (which have lesser "certificate issuing" power). Hence, the compromise of one intermediate CA does not directly lead to the compromise of the primary CA or other CAs.


I found a good explanation here: https://technet.microsoft.com/en-us/library/dn786436.aspx

To summarize it: In case of 1 layer design (RootCA issues endpoint certificates) - it´s not recommended due to obvious reasons.

In case of large and expensive 3-layer design, you get great scalability, you can enforce different CA policies on each of the off-line Intermediate CA, you can revoke part of your PKI "tree" and still work fine with the rest. It is used by worldwide known CA brands, like GoDaddy, Symantec, Thawte, ...

In case of 2 levels, it is a compromise between both. Usually it is used for internal company needs, for company PKI. RootCa is preinstalled only on company PCs. It is relatively cheap, well managable by 2-3 persons and still scalable. You can have IntermediateCA level of online CAs, which you use for issuing internal domain certificates, VPN certificates, 3-party access certificates, ... - each CA with different policy.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .