How deeply does Software Security for Developers cover intermediate certificate?

Traces issuer relationships and OpenSSL verification, without explaining cryptographic proofs or revocation procedures in detail.

Intermediate certificate

As explained in Software Security for Developers

An intermediate certificate authority is a certificate authority certified by another authority and used to issue certificates below a root authority in a trust hierarchy.

An intermediate certificate authority (CA) is certified by a root CA or another intermediate CA. It issues end-entity certificates, such as a certificate for github.com, while keeping root certificates out of direct issuance. section 8.2.1 section 8.3

Trust is established by checking the end-entity certificate, then following its issuer to the intermediate CA and finally to a trusted root in the operating system, browser, or runtime trust store. section 8.4 section 8.2.1

Diagnosing a missing intermediate

Running openssl verify github-cert.pem can produce “unable to get local issuer certificate.” Supplying the intermediate certificate with -CAfile allows OpenSSL to build the chain: github.com at depth 0, the intermediate CA at depth 1, and DigiCert Global Root CA at depth 2.

How Software Security for Developers covers it

Cover of Software Security for Developers

liveBook manning.com

Read Software Security for Developers on liveBook Get the book at manning.com

Related concepts

certification authoritykind of · A certification authority is a trusted entity that verifies identities and issues digitally signed certificates binding public keys to identities or domains.
certificate chainpart of · A certificate chain is an ordered sequence of digital certificates linking an end-entity certificate through intermediate authorities to a trusted root certificate.
root certificateproduced by · A root certificate is a trusted certificate, typically self-signed, that serves as a trust anchor for validating a certificate chain and authorizing subordinate certificates.

This explainer was generated by Manning's knowledge graph from the text of Software Security for Developers. The section links point to the parts of the book it draws on.