# Digital Certificate Chain Verification

Does a certificate contain the complete chain of all certificates up to the trusted root certificate, or does the program that verifies certificates have to fetch each parent certificate individually in the chain to reach a trusted root certificate?

-

 The certificate wouldn't need to be resigned; the site just needs to change where it tells the browsers to find the other certificates. $\:$ – Ricky Demer Aug 14 '12 at 6:45 @RickyDemer, thinking about it again, I believe you are right. Initially I figured that if the locations were not part of what was signed (i.e., locations were not authenticated) an attacker could leverage this to potentially defeat the system. But, even in SSL, the entire chain is not authenticated, so an attacker could replace one of the certs in the chain and not defeat the system. I will correct my answer. – mikeazo♦ Aug 14 '12 at 11:30