0
$\begingroup$

If we view the certificate chain using Firefox, we can see the certificate signature of "server certificate" and its "intermediate-CA" right after the "certificate signature algorithm" in the certificate field

In the packet capture, this is returned by the server:

1) server certificate, its public key, its certificate signature algorithm, and followed by some thing encrypted (I guess this is the certificate signature, no?)

2) intermediate CA certificate, its public key, its certificate signature algorithm, and followed by some thing encrypted. (I guess this is the certificate signature too, no? )

My question, which key is used to encrypt the certificate signature of "server certificate" and "intermediate CA"?

If server private key is used to encrypt certificate signature for both server certificate and intermediate CA, then server's public key can be used to decrypt and view their certificate signature

If intermediate CA used its own private key to encrypt the certificate signature, then must use the intermediate CA public key to decrypt and view its certificate signature - however, the server will not have the private key of the intermediate CA, then how can this happen? Unless when configuring the certificate chaining in the server, the imported intermediate CA already has the certificate signature encrypted?

Appreciate if someone can shed some light.

Improve this question
$\endgroup$

1 Answer 1

Reset to default
1
$\begingroup$

The intermediate certificate is signed by its issuer(a root CA or another intermediate CA), using the private key of the issuer's certificate.

The server certificate is signed by the intermediate CA at the lowest level of the certificate chain.

when configuring the certificate chaining in the server, the imported intermediate CA already has the certificate signature encrypted?

Yes, when you want a certificate for your domain, you ask for it from an intermediate CA. After the CA verifies that you're the actual owner of the domain, they give you a certificate signed by the CA's private key. Then you can configure to use it on your server.

The intermediate certificates are simply available to the public, they are sent by the server generally for clients that don't have them installed.

Improve this answer
$\endgroup$
1
  • $\begingroup$ And to be complete the intermediate (signed by the root's privatekey) is verified using that root's publickey usually (always?) in the form of a root cert in the browser's or other client's truststore. There's a nice picture of this cross-stack at security.stackexchange.com/questions/56389/… $\endgroup$
    – dave_thompson_085
    Commented Jul 28, 2017 at 3:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.