Certificate Chain of Trust: Roots and Intermediates

What is a certificate chain of trust?

A certificate chain of trust connects a signing certificate through issuing certificates to a trust anchor accepted by the relying system. The chain helps establish whether the public-key binding can be relied on for the intended use.

Leaf, intermediate and root certificates

• Leaf or end-entity certificate: identifies the signing subject and public key.
• Intermediate CA certificate: identifies a CA authorized to issue certificates within the applicable constraints.
• Root certificate: commonly represents an accepted trust anchor, often in self-signed form.

A self-signed certificate is signed with the private key corresponding to its own public key. That does not automatically make it trusted or defective. Trust comes from accepting the anchor through an appropriate process, not simply from verifying its self-signature.

Building a path versus validating it

RFC 4158 addresses finding certification paths; validating a proposed path is a separate task. Issuer signatures, constraints, intended usage, relevant time and certificate status still matter. A supplied sequence of certificates is not proof that the recipient trusts its root.

Different viewers or organizations can use different trust anchors and policies. A chain accepted in one environment is therefore not automatically accepted everywhere.

Certificate policy and certification practice

A certificate policy (CP) describes applicability and requirements for a certificate community or use. A certification practice statement (CPS) describes the issuer’s practices. RFC 3647’s policy framework distinguishes these related documents.

Consider the issuer’s role and these policy conditions as part of signature validation. A mathematically consistent path alone does not establish QES status or a representative’s legal authority.