2

I have to install 2 certificates on a computer and I am a little puzzled by the certificates.

The first certificate has these details:

Issuer:

CN = AddTrust External CA Root
OU = AddTrust External TTP Network
O = AddTrust AB
C = SE

Subject:

CN = AddTrust External CA Root
OU = AddTrust External TTP Network
O = AddTrust AB
C = SE

The Certification path is: AddTrust External CA Root

The 2nd certificate: Issuer:

CN = AddTrust External CA Root
OU = AddTrust External TTP Network
O = AddTrust AB
C = SE

Subject:

CN = COMODO SSL CA
O = COMODO CA Limited
L = Salford
S = Greater Manchester
C = GB

The computer I need to install these certificates on could well be acting as a https server. This is something I am unsure on at this stage. But I am puzzled by the above certificates.

The first certificate has the same Issuer and Subject. But I thought the Issuer should be the CA authority and the Subject should be the owner of the certificate which is being certified by the CA. But they are the same? Why?

The second certificate is a SSL certificate? It has issuer Addtrust and Subject Comodo. So here I am assuming AddTrust is the CA. AddTrust is verifying that Comodo in Salford, GB should be trusted (and of course this certificate is valid).

But why do I need the first certificate?

What is the purpose of certificate 2? I understand it is a SSL certificate. But how could the computer I install it on potentially need this?

1

You do not have to install them. This is the certificate chain the webserver should provide for the clients so they are able to verify the certificate.

The CA's root certificate is in the browsers or OS' store of trusted certificates. CA's usually don't sign client's CSRs with the root certs, but with intermediate certificates, which are by themselves signed by the root cert. The browser receives the websites certificate and can also download the chain. The browser or any other client can then verify the chain by comparing the signatures until the program ends at the root certificate. The root certificate will then be compared to the certificate in the trust store.

The certificates should be put into a file together with the websites certificate. The webserver should then be configured to use this file as CA-file.

  • So from what you are saying, then I am thinking my client application downloads the server certificate - but the PC needs the AddTrust Root and the ComodoSSL certificates as the higher up levels so that my web browser/client app will trust XYZ web server via SSL? – user619818 Jul 17 '15 at 10:52
  • @user619818 Yes, exactly. – sebix Jul 17 '15 at 19:46
  • But isn't that a bit rubbish. Shouldn't the CA already be trusted by the operating system? – user619818 Jul 18 '15 at 8:50
  • The CA is trusted, but not the intermediates which are necessary to verify the leaf certificate (e.g. of the website). – sebix Jul 18 '15 at 12:30
  • Actually you should also note that many implementation store (aka install) the intermediate certificates, just because they want to. (That is a kind of caching, maybe it makes other connections using the same intermediate cert faster.) – rugk Jul 21 '16 at 13:27

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.