Certificate chains are used to be able to verify an end user certificate against a list of intermediaries and a root authority. We are going to explain this in a bit more detail. The Certificate Authority In order for an SSL certificate to be trusted, a certificate must have been issued by a certificate authority (CA) that is included in the trusted store of the device that is connecting. If the certificate was not issued by a trusted CA, the connecting device will then check to see if the certificate of the issuing CA was issued by a trusted CA, and so on until either a trusted CA is found or no trusted CA can be found. Common certificate authorities Commonly used certificate authorities, such as Verisign, DigiCert, and Entrust, are automatically trusted by most browsers. However, if you use an untrusted internal certificate authority to generate SSL certificates for internal resources, you will be nagged by your browser when you attempt to connect. Example of when an SSL certificate is not trusted. How a Certificate Chain Works You decide to purchase a certificate for the domain from a certificate supplier called It’s important to note, that certficates.ca is not a root authority, and therefore cannot be explicitly trusted. google.com certificates.ca. A chain of trust must be built, by certificates.ca having intermediate certificates issue certificates up the chain all the way to a root CA. Here is an example of a 5 chain certificate: google.com — issued by certificates.ca (end user certificate) intermediate certificate — issued to certificates.ca, issued by some-intermediate-1.ca intermediate certificate — issued to some-intermediate-1.ca, issued by some-intermediate-2.ca intermediate certificate — issued to some-intermediate-2.ca, issued digicert.ca root certificate — issued to digicert.ca, by digicert.ca - (Your Private Key: your_domain_name.key)
- - (Your Primary SSL certificate: your_domain_name.crt)
- - (Your Intermediate certificate: DigiCertCA.crt)
- - (Your Root certificate: TrustedRoot.crt)
- ---- RSA PRIVATE KEY----- BEGIN ---- RSA PRIVATE KEY----- END ---- CERTIFICATE----- BEGIN ---- CERTIFICATE----- END ---- CERTIFICATE----- BEGIN ---- CERTIFICATE----- END ---- CERTIFICATE----- BEGIN ---- CERTIFICATE----- END Installing a certificate When you install an end-user certificate, such as the one in the example above bought from certificates.ca, you have to bundle the intermediate certificates and install them also. This certificate chain enables the receiver to verify that the sender, and all certificates in the chain are trustworthy, but if the SSL certificate chain is invalid or broken, your certificate will not be trusted by some devices. Previously published at https://codeburst.io/understanding-certificate-chains-b55162d95312

Chain

Google

How the Domain Name System Works

☁️ Cloud Consultant / tech writer🖊️ 

Read My Stories

Too Long; Didn't Read

Download free Tech Leaders Productivity Report!

How Certificate Chains Works

About Author

Comments

TOPICS

THIS ARTICLE WAS FEATURED IN

Related Stories

Untitled Story

How the Domain Name System Works

10 Cool CI/CD Tools For Your Project

27 Stories To Learn About Ssl

20 Essential Backend Tools For Developers

3 Most Common Ways to Connect your Node and React Applications

How the Domain Name System Works

10 Cool CI/CD Tools For Your Project

27 Stories To Learn About Ssl

20 Essential Backend Tools For Developers

3 Most Common Ways to Connect your Node and React Applications

Light-Mode

Classic

Newspaper

Dark-Mode

Neon Noir

Minty

HN StartUps