Storage on Root CA and intermediate CA certificate on Embedded device

Question

Regarding the storing of Root CA certificates on an Embedded device

Setup Explaination: 1. An embedded device which is a CLIENT on the network 2. There is a SERVER which connects to the CLIENT on SSL/TLS

Also we can access the server from any web browser. We have extracted the the following certificates from the web browser when connected to SERVER.

The certificates are

1. Root CA 2. Intermediate **CA Domain validation CA.**

It is seen that in the browser it is stores as a chain of certificates.

Now the query is do we need to store both of the certificates on our embedded devices or any one is sufficient. If only one then it should be a root CA or intermediate Domain Validation CA certificates.

Kindly need inputs asap.

Thanks in advance.

Regards,

SSK

Answer 1

Embedded device or not, the only requirement is that you have to be able to follow the cert chain up to something you trust. So if your server is indeed delivering the whole chain (as you seem to imply it), you'd only need to store the Root CA in the embedded device.

Answer 2

It can be either one. Just storing the root is more usual, as it is usually valid for a longer time. CA private keys are generally more exposed, so it is more likely that they have to be revoked for some reason.

If you just store the root then you do need enough validation criteria to make sure you only accept certificates within the right certificate path. If there is another intermediate CA then you might not want to accept certificates issued by that CA.

In general it is not sufficient to only verify certificates to a trusted root to trust the leaf certificate. You also need to perform DNS name validation, validity period, revocation status etc.