Digital Certificate Chain Verification

Question

Does a certificate contain the complete chain of all certificates up to the trusted root certificate, or does the program that verifies certificates have to fetch each parent certificate individually in the chain to reach a trusted root certificate?

Answer 1

In Theory
In theory, either method works and has its advantages and disadvantages. Sending the entire chain up to the root means the other party (e.g., web browser) has everything they need to do the validation. A disadvantage is that more bandwidth is used.

Sending only the one certificate could yield better bandwidth usage (the verifying party still has to request other certs in the chain, but these could be cached). But, the certificates then must embed information on how to retrieve the next link in the chain. This creates problems because if that information ever changes. In the case of SSL, then, the server would have to constantly be checking if the location was still valid and accessible. This could lead to DOS attacks on any server in the certification chain causing the server to be inaccessible.

In Practice
I'm not exactly sure how existing protocols do this. It seems that SSL requires you to install the entire chain on the server (e.g., instructions for apache).