Certificate chain

As explained in Real-World Cryptography

An ordered set of certificates linking a subject certificate through intermediate certificate authorities to a trusted root.

A certificate chain lets a browser connect a website’s identity to a root certificate it already trusts. It is sent by the server during the TLS handshake. section 9.2.1

Read the chain from the website outward:

• Leaf certificate: identifies the domain, such as google.com, and contains the website’s long-term public key. section 9.2.1
• Intermediate CA certificates: connect the leaf certificate to a root CA through signatures. section 9.2.1
• Root certificate: ends the chain and is trusted because it is stored in the browser’s trust store. section 9.2.1

Following Google’s chain

A browser can validate a Google certificate for *.google.com through the intermediate GTS CA 101, whose certificate is signed by the trusted GlobalSign root CA. section 9.2.1

Figure 9.6 The authentication part of a handshake starts with the server sending a certificate chain to the client. The certificate chain starts with the leaf certificate (the certificate containing the website’s public key and additional metadata like the domain name) and ends with a root certificate that is trusted by the browser. Each certificate contains a signature from the certificate above it in the chain.

Trace the leaf-to-root order and see how each certificate is signed by the certificate above it. section 9.2.1

How Real-World Cryptography covers it

How deep it goes

Explains leaf, intermediate, and root certificates, but stops short of detailed certificate-validation algorithms.

Examples

Uses Google’s certificate chain, browser trust stores, and the leaf-to-root signature sequence.

What it assumes

Assumes basic familiarity with TLS, public keys, digital signatures, browsers, and certificate authorities.

What you can do after

Evaluate how a browser connects a website certificate to a trusted root during TLS authentication.

How it connects

Connects TLS handshakes, certificate authorities, public-key cryptography, trust stores, and man-in-the-middle attacks.

liveBookmanning.com

Read Real-World Cryptography on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Software Security for DevelopersA certificate chain is an ordered sequence of an end-entity certificate and the certificates of the intermediate and root authorities that establish its trust.
• 

  liveBookmanning.com
  ASP.NET Core in Action, 3eA certificate chain is an ordered sequence of digital certificates linking a server certificate to a trusted root certificate.

Compare how 3 books explain certificate chain →

Related concepts

• certificate validationused by · Certificate validation is the process of verifying a digital certificate’s authenticity, validity period, issuer trust, identity, and applicable constraints.
• self-signed certificatecontrasts with · A self-signed certificate is a digital certificate whose signature is created by the same entity and key identified by the certificate rather than by a certificate authority.
• root certificatehas part · A root certificate is a trusted certificate, typically self-signed, that serves as a trust anchor for validating a certificate chain and authorizing subordinate certificates.
• intermediate certificatehas part · An intermediate certificate is a certificate issued by a root or higher-level certificate authority to establish a trust chain for end-entity certificates.
• certificatehas part · A digital certificate is a digitally signed credential that binds an identity to a public key and supports authentication or secure communication.

This explainer was generated by Manning's knowledge graph from the text of Real-World Cryptography. The section links point to the parts of the book it draws on.