Understanding certificate signing chains
A certificate signing chain, also known as a certificate verification chain, simply a certificate chain, or a chain of trust, is an ordered collection of certificates where each certificate is signed by the next certificate in the collection. All except the last certificate, of course. The last certificate is self-signed.
Why are certificate signing chains needed? In order to verify the certificate validity. A curious reader might ask, doesn’t the certificate’s private key solve this problem? No, it’s not so easy. When verifying identity using an X.509 certificate, we have to verify two claims:
- That whoever presents the certificate for identification owns the certificate: This claim is proven using the certificate’s private key.
- That the presented certificate is valid: This claim is proven using the certificate signing chain.
It is similar to how you identify yourself with a passport. You can...
