liveBook · Manning

End entity

As explained in Software Security for Developers

An end-entity certificate is a certificate issued to a final subject such as a website, service, organization, or individual rather than to another certificate authority.

An end entity is the final subject named by a certificate, such as a website, service, organization, or individual. Unlike a certificate authority, it does not issue certificates to another authority. Its certificate binds the subject’s identity and public key, with the issuer and validity period providing essential verification context. section 8.3 section 8.4

Place the certificate at the bottom of the trust hierarchy:

  • The end-entity certificate identifies the service being contacted, such as github.com. section 8.2.1
  • An intermediate CA issues the end-entity certificate. section 8.3
  • A trusted root CA anchors verification through the operating system or browser trust store. section 8.2.1

GitHub’s certificate chain

OpenSSL verifies github.com by checking its end-entity certificate, then the DigiCert intermediate certificate, and finally the trusted DigiCert Global Root CA. A missing issuer can make verification fail. section 8.2.1

Listing 8.9 The certificate chain
github-cert.pem: OK   #1
Chain:
depth=0: C = US, ST = California, L = San Francisco, O = "GitHub, Inc.", 
CN = github.com (untrusted)  #2
depth=1: C = US, O = DigiCert Inc, 
CN = DigiCert TLS Hybrid ECC SHA384 2020 CA1   #3
depth=2: C = US, O = DigiCert Inc, OU = www.digicert.com, 
CN = DigiCert Global Root CA   #4

Inspect the certificate chain from the end entity at depth 0 to the trusted root at depth 2. section 8.2.1

How Software Security for Developers covers it

How deep it goes
Defines the role and chain position, but defers certificate-authority issuance details.
Examples
Uses github.com, DigiCert certificates, OpenSSL verification, and a three-level certificate-chain listing.
What you can do after
Evaluate certificate chains by locating the final subject and following verification to a trusted root.
How it connects
Connects X.509 certificates with public keys, certificate authorities, trust stores, digital signatures, and certificate validation.
Cover of Software Security for Developers
liveBookmanning.com
Read Software Security for Developers on liveBook Get the book at manning.com

This explainer was generated by Manning's knowledge graph from the text of Software Security for Developers. The section links point to the parts of the book it draws on.