SSL Chain of Trust | How SSL Chain Works | Self-Signed Certificate, Root Cert, Intermediate Certificate, Server Certificate(Leaf)
Self Signed Certificate
Self Signed Certificates are certs where both the Issued To and the Issued By field of the certificates are same. In simple words it is a certificate where one issues a certificate to itself and hence the name Self Signed Certificate. Here is one example:
As seen in the above image the Issued to and Issued by are same. You may also observe the warning indicating that the certificate is not trusted.
For this example let’s visit https://cisco.com/ and go to below path and export the certificate which server certificate(Leaf) which contain intermediate and root certificate details as well.
Root CA Certificate
Root CA Certificate is a CA Certificate which is simply a Self-signed Certificate. This certificate represents a entity which issues certificate and is known as Certificate Authority or the CA.
It comes pre-downloaded in most browsers and is stored in what is called a “trust store.” The root certificates are closely guarded by the Certificate Authorities.
Role: to issue intermediate CAs as well as to sign, verify, and provide third-party validation for other SSL certificates within the chain.
Root certificate, the most important in the chain. If the CA issuing it is distrusted or revoked, the chain of trust is broken.
Intermediate Certificate:
Intermediate certificates branch off of root certificates like branches off of trees. They act as middle-men between the protected root certificates and the server certificates issued out to the public. There will always be at least one intermediate certificate in a chain, but there can be more than one.
Intermediate certificate issued to protect the root certificates and for issuing end server and leaf certificates.
These certificates sign your server SSL/TLS certificate, and, in turn, are signed by the private key of the root certificate that issued it, in order to establish trust.
All certificate chains must contain at least one intermediate certificate, and it must be installed on the server to ensure its compatibility with all clients — from browsers, to mobile devices, and applications. The trustability of an intermediate CA is tied to its linkage to the root CA.
Server Certificate (leaf certificate) —
A server or leaf certificate is a digital certificate issued to a web server by a CA for the domain the user wants to visit.
Its main purpose is to verify the server’s identity and establish a secure encrypted connection between the server and the client’s web browser.
How Is an SSL Certificate Chain Validated?
Step-by-Step Validation
- Server’s Certificate: The client receives the server’s certificate.
- Intermediate Certificate: The server’s certificate is signed by an intermediate CA. The client retrieves or receives the intermediate certificate.
- Root Certificate: The intermediate certificate is signed by a root CA, which is pre-installed in the client’s trust store.
- Signature Verification: The client uses the public key of the root certificate to verify the signature on the intermediate certificate and uses the public key of the intermediate certificate to verify the server’s certificate.
- Attributes and Revocation Check: The client checks the validity dates, key usage, and whether the certificates are revoked.
- Trust Root Certificate: Finally, the client checks that the root certificate is in its trusted store.
Conclusion
The SSL certificate chain validation ensures that each certificate in the chain is properly issued by a trusted entity, and that the certificates are currently valid and not revoked. This chain of trust is fundamental to establishing a secure SSL/TLS connection.
Export Intermediate and Root Certificate from Server Certificate
