Before you go, check out these stories!

Hackernoon logoHow Certificate Chains Works by@digitalbeardy

How Certificate Chains Works

Author profile picture

@digitalbeardyCraig Godden-Payne

โ˜๏ธ Cloud Software Consultant ๐Ÿ–Š๏ธ #DevOps ๐Ÿš€ #Serverless โšก#Javascript ๐Ÿ”ฅ #DotNet ๐Ÿ‘Š #MachineLearning

Certificate chains are used to be able to verify an end user certificate against a list of intermediaries and a root authority. We are going to explain this in a bit more detail.

The Certificate Authority

In order for an SSL certificate to be trusted, a certificate must have been issued by a certificate authority (CA) that is included in the trusted store of the device that is connecting.

If the certificate was not issued by a trusted CA, the connecting device will then check to see if the certificate of the issuing CA was issued by a trusted CA, and so on until either a trusted CA is found or no trusted CA can be found.

Common certificate authorities

Commonly used certificate authorities, such as Verisign, DigiCert, and Entrust, are automatically trusted by most browsers. However, if you use an untrusted internal certificate authority to generate SSL certificates for internal resources, you will be nagged by your browser when you attempt to connect.

Example of when an SSL certificate is not trusted.

How a Certificate Chain Works

You decide to purchase a certificate for the domainย google.comย from a certificate supplier calledยย Itโ€™s important to note, that is not a root authority, and therefore cannot be explicitly trusted.

A chain of trust must be built, by having intermediate certificates issue certificates up the chain all the way to a root CA.

Here is an example of a 5 chain certificate:

  1. โ€” issued by (end user certificate)
  2. intermediate certificate โ€” issued to, issued by
  3. intermediate certificate โ€” issued to, issued by
  4. intermediate certificate โ€” issued to, issued
  5. root certificate โ€” issued to, by
(Your Private Key: your_domain_name.key)
(Your Primary SSL certificate: your_domain_name.crt)
(Your Intermediate certificate: DigiCertCA.crt)
(Your Root certificate: TrustedRoot.crt)

Installing a certificate

When you install an end-user certificate, such as the one in the example above bought from, you have to bundle the intermediate certificates and install them also.

This certificate chain enables the receiver to verify that the sender, and all certificates in the chain are trustworthy, but if the SSL certificate chain is invalid or broken, your certificate will not be trusted by some devices.

Previously published at


Become a Hackolyte

Level up your reading game by joining Hacker Noon now!