2

I have to install 2 certificates on a computer and I am a little puzzled by the certificates.

The first certificate has these details:

Issuer:

CN = AddTrust External CA Root
OU = AddTrust External TTP Network
O = AddTrust AB
C = SE

Subject:

CN = AddTrust External CA Root
OU = AddTrust External TTP Network
O = AddTrust AB
C = SE

The Certification path is: AddTrust External CA Root

The 2nd certificate: Issuer:

CN = AddTrust External CA Root
OU = AddTrust External TTP Network
O = AddTrust AB
C = SE

Subject:

CN = COMODO SSL CA
O = COMODO CA Limited
L = Salford
S = Greater Manchester
C = GB

The computer I need to install these certificates on could well be acting as a https server. This is something I am unsure on at this stage. But I am puzzled by the above certificates.

The first certificate has the same Issuer and Subject. But I thought the Issuer should be the CA authority and the Subject should be the owner of the certificate which is being certified by the CA. But they are the same? Why?

The second certificate is a SSL certificate? It has issuer Addtrust and Subject Comodo. So here I am assuming AddTrust is the CA. AddTrust is verifying that Comodo in Salford, GB should be trusted (and of course this certificate is valid).

But why do I need the first certificate?

What is the purpose of certificate 2? I understand it is a SSL certificate. But how could the computer I install it on potentially need this?

Improve this question
1
  • 1
    Have a look here
    – BadSkillz
    Commented Jul 17, 2015 at 9:22

1 Answer 1

Reset to default
1

You do not have to install them. This is the certificate chain the webserver should provide for the clients so they are able to verify the certificate.

The CA's root certificate is in the browsers or OS' store of trusted certificates. CA's usually don't sign client's CSRs with the root certs, but with intermediate certificates, which are by themselves signed by the root cert. The browser receives the websites certificate and can also download the chain. The browser or any other client can then verify the chain by comparing the signatures until the program ends at the root certificate. The root certificate will then be compared to the certificate in the trust store.

The certificates should be put into a file together with the websites certificate. The webserver should then be configured to use this file as CA-file.

Improve this answer
5
  • So from what you are saying, then I am thinking my client application downloads the server certificate - but the PC needs the AddTrust Root and the ComodoSSL certificates as the higher up levels so that my web browser/client app will trust XYZ web server via SSL?
    – user619818
    Commented Jul 17, 2015 at 10:52
  • @user619818 Yes, exactly.
    – sebix
    Commented Jul 17, 2015 at 19:46
  • But isn't that a bit rubbish. Shouldn't the CA already be trusted by the operating system?
    – user619818
    Commented Jul 18, 2015 at 8:50
  • The CA is trusted, but not the intermediates which are necessary to verify the leaf certificate (e.g. of the website).
    – sebix
    Commented Jul 18, 2015 at 12:30
  • Actually you should also note that many implementation store (aka install) the intermediate certificates, just because they want to. (That is a kind of caching, maybe it makes other connections using the same intermediate cert faster.)
    – rugk
    Commented Jul 21, 2016 at 13:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .