The question is not about mathematical cryptography but about the practical usage of certificates and their chained verification. Please let me know, if this is the wrong place to post the question.

Lets say I have the end certificate E, signed by S, which is itself signed by the (self signed) root R:

R <--- S <--- E

R is the certificate I can trust per definition (independently of how it finds its way into the system)

During verifying E against S I have to verify S against R.

Now, two cases:


after some period of months I get a new version of E, lets say E2:

R <--- S <--- E2

Is it now OK to "trust" S, because it has been verified against R previously? Can I stop at S or do I need to go up until R again?

In other words: can I rely on a given certificate to be trusted when it already got verified before?


When I get a new S, lets say S2

R <--- S2

is it acceptable to verify S2 immeadiately against R and make it to a trusted certificate in the sense, that when I get a new end certificate E3

R <--- S2 <--- E3

I can stop verification at S2 and skip the remaining chain, because S2 has already been verified (once)?

To ask the other way around: What is the meaning of a trusted certificate and what is the difference to the "root" certificate?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.