Some SSL certificates have two certification paths. In other words: the trust-chain can take two paths. I installed all the certificates for one path but that gave an HTTPS error on some older devices. I looked up how this can occur. I found out that some older Android versions can't follow the link to the other certificate that was included in the certificate. That I fixed.

Real question
My real question is this: How is it determined which certification path is chosen by a application? What is the logic behind this?


1 Answer 1


There doesn't seem to be a standard. For Microsoft's CryptoAPI:

When the computer finds multiple trusted certification paths during the certificate validation process, Microsoft CryptoAPI selects the best certification path by calculating the score of each chain. A score is calculated based on the quality and quantity of the information that a certificate path can provide. If the scores for the multiple certification paths are the same, the shortest chain is selected.

That sounds very ad hoc to me. Also, from the 2002 PKI Forum, 2002, Understanding Certification Path Construction (thanks to @StackzOfZtuff for the reference):

The certification path construction process has not been standardized, and there is very little published information available to help implementers and product evaluators understand the complexities involved.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .