Regarding the storage of Root CA certificate and any Intermediate root CA certificate on Embedded Device

Question

The overall system setup is as explained

1. SERVER which connects with the client(Embedded device) on SSL/TLS
2. Embedded Device which acts a CLIENT and communicates with the server

The Server can also be accessed using web browsers (mozilla, chrome etc).

Through the web browser we downloaded/extracted the root CA certificates which were stored in the web browsers (Clients). It consists of 2 Root CA,

1. Root CA

This is the self signed certificate by CA

2. Intermediate CA Domain validation CA

This certificate is signed by Root CA

This certificate is used to signed the server certificate

We needed Root CA(s) on the embedded device so that it can be used to authentic the server during the SSL/TLS handshake.

So for our embedded device, if we need to put the root CA certificates, as per our knowledge we should be able to use the same certificates which can be embedded in the firmware.

Question: do we need to store both the certificates (Root and Intermediate CA) on the embedded device or any one of them is sufficient? If only one, which one should be stored?

Answer 1

Only the Root-CA needs to be known (and trusted) by the client. Everything else can be chained on demand.

Your server can be instructed to send the intermediate certificate along with the server certificate. This process is called "certificate chaining" and often implemented by concatenating both certificates into a single certificate file; older versions of e.g. Apache Webserver required a specific statement ( SSLCertificateChainFile ).

A client receiving this chain of certificates does follow the server's certificate via its issuing CA until it reaches a client-trusted Root CA; if it doesn't reach a client-trusted Root-CA, the certificate will be regarded as "not trusted" and depending on the actual client application, the application will refuse to send data over that (encrypted, but not authenticated) connection.

Please also do keep in mind Root CAs do have an expiration date, so (depending on the estimated lifetime of device and Root CA) you may need to update or exchange Root CA certificates on your embedded client device as well.