0
$\begingroup$

I have the trusted root certificate which I am validating using the self signed key. I also have the intermediate certificate, which i am validating using the root certificate. Now when i am validating the certificate do i need to trace back the whole chain to validate the certificate? Or can i say i have done TPC, if i just validate it using the intermediate only(since i have already validated my intermediate with its root before)?

Improve this question
$\endgroup$

2 Answers 2

Reset to default
1
$\begingroup$

Now when i am validating the certificate do i need to trace back the whole chain to validate the certificate?

Not each time, no. You can do some caching, if you like (since root CAs tend to be valid for many years). But I don't think performance gains will be worth the added complexity of the caching idea.

Also: if you plan to honor the expiration dates in the root CA itself, then you have to check these using some other mechanism.

Also: you may have to account for the (unlikely) case of the intermediate CA being revoked.

So, unless you have a good reason not to check each time, then I recommend checking the complete chain from end-entity-certificate (inclusive) up to trust-anchor (inclusive). It's easier to understand.

Improve this answer
$\endgroup$
0
$\begingroup$

Of course, since the X509 is statically signed, you have to check the signature only once.

Improve this answer
$\endgroup$
1
  • $\begingroup$ Actually, it is incorrect, because there might be circumstances when the trust ends. See @StackzOfZtuff response for more details. $\endgroup$
    – Crypt32
    Commented Oct 6, 2015 at 6:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.