Does a certificate contain the complete chain of all certificates up to the trusted root certificate, or does the program that verifies certificates have to fetch each parent certificate individually in the chain to reach a trusted root certificate?
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
Sending only the one certificate could yield better bandwidth usage (the verifying party still has to request other certs in the chain, but these could be cached). But, the certificates then must embed information on how to retrieve the next link in the chain. This creates problems because if that information ever changes. In the case of SSL, then, the server would have to constantly be checking if the location was still valid and accessible. This could lead to DOS attacks on any server in the certification chain causing the server to be inaccessible.