How deeply does Software Security for Developers cover certificate chain?

Traces signatures and trust from end entity through intermediate to root, while deferring deeper cryptographic and revocation mechanics.

Certificate chain

As explained in Software Security for Developers

A certificate chain is an ordered sequence of an end-entity certificate and the certificates of the intermediate and root authorities that establish its trust.

A certificate chain is an ordered path from an end-entity certificate, such as github.com, through intermediate certificates to a trusted root certificate. This path lets a verifier confirm the server’s identity and the authenticity of its public key. section 8.2.1 section 8.4

The chain commonly contains three certificate roles:

End-entity certificate: identifies the server or other subject, such as github.com. section 8.3
Intermediate certificate: is issued by a root or higher-level intermediate CA and signs end-entity certificates. section 8.2.1 section 8.3
Root certificate: is self-signed and already trusted through an operating-system, browser, or runtime trust store. section 8.2.1 section 8.4

Diagnosing a missing issuer

Running `openssl verify github-cert.pem` can fail with `unable to get local issuer certificate`. Supplying the intermediate certificate allows OpenSSL to build the path: github.com at depth 0, DigiCert TLS Hybrid ECC SHA384 2020 CA1 at depth 1, and DigiCert Global Root CA at depth 2. Verification succeeds when that root is trusted.

How Software Security for Developers covers it

Cover of Software Security for Developers

liveBook manning.com

Read Software Security for Developers on liveBook Get the book at manning.com

Also explained in

liveBook manning.com

Real-World CryptographyAn ordered set of certificates linking a subject certificate through intermediate certificate authorities to a trusted root.
liveBook manning.com

ASP.NET Core in Action, 3eA certificate chain is an ordered sequence of digital certificates linking a server certificate to a trusted root certificate.

Compare how 3 books explain certificate chain →

Related concepts

certificate validationused by · Certificate validation is the process of verifying a digital certificate’s authenticity, validity period, issuer trust, identity, and applicable constraints.
self-signed certificatecontrasts with · A self-signed certificate is a digital certificate whose signature is created by the same entity and key identified by the certificate rather than by a certificate authority.
root certificatehas part · A root certificate is a trusted certificate, typically self-signed, that serves as a trust anchor for validating a certificate chain and authorizing subordinate certificates.
intermediate certificatehas part · An intermediate certificate is a certificate issued by a root or higher-level certificate authority to establish a trust chain for end-entity certificates.
certificatehas part · A digital certificate is a digitally signed credential that binds an identity to a public key and supports authentication or secure communication.

This explainer was generated by Manning's knowledge graph from the text of Software Security for Developers. The section links point to the parts of the book it draws on.