1
$\begingroup$

In PKI there are different terms to identify certificate authorities in the chains. All terms I know of are as follow:

  1. Root
  2. Subordinate
  3. Super
  4. Intermediate

I see all terms used interchangeably in the combination with “certificate authority (CA)” and “certificate”. I read a lot of web pages as well as books and my personal understanding from all of this is as follow:

  • A CA is called a root if it’s certificate has no super certificate.
  • A CA is called a subordinate if it’s intermediate certificate has a super certificate of another subordinate or root CA.

What is the actual meaning of the four terms and their relation to each other?

How is this question of a practical matter to cryptography?

I‘m not entirely sure if this question fits this StackExchange or if it should go somewhere else. However, I consider this question to be directly related to cryptography since it is about PKI and the nomenclature is specific to the world of cryptography and PKI.

The practical matter comes into play during communication – especially in documentation – regarding PKI, CAs, and certificates.

Improve this question
$\endgroup$
0

1 Answer 1

Reset to default
2
$\begingroup$
  1. A CA certificate is a certificate which is used to sign other certificates. This is indicated by the Basic Constraints extension
  2. A root certificate is a certificate which is self signed i.e. not signed by another CA cert
  3. An intermediate certificate is any (CA) certificate in a certificate chain between the root and the leaf. Those are also sometimes called Sub CA. Usually, there is one such in a chain.
  4. Super and subordinate means exactly what it says. Remember that you are working with a certificate chain.
Improve this answer
$\endgroup$
3
  • $\begingroup$ So intermediate and subordinate are actually both the very same? $\endgroup$
    – Fleshgrinder
    Commented Jul 18, 2019 at 13:42
  • 1
    $\begingroup$ They can refer to the same certificate but are used relative to different things. One CA certificate might be subordinate to a root certificate and intermediate in a chain. $\endgroup$
    – mat
    Commented Jul 18, 2019 at 15:56
  • $\begingroup$ This matches my understanding and based on that I would always write about the subordinate CA when I am describing in the documentation that I am about to generate a new CA signed by the root CA that was generated previously. I am accepting your answer under the premise that your comment is part of it. $\endgroup$
    – Fleshgrinder
    Commented Jul 19, 2019 at 18:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.