A certificate is essentially a digital identity card. But why does your browser trust a certificate issued by 'DigiCert' or 'Let's Encrypt'? Because they are part of a hierarchical trust model where trust is inherited from a top-level authority.
At the top of the pyramid is the Root Certificate Authority (CA). A Root CA certificate is 'self-signed'. The only reason we trust it is that the certificate is pre-installed in our operating system's 'Trust Store' (e.g., Windows Root Store, Mozilla Root Store). If you manually add a Root CA to your device, you are telling the OS: 'Trust everything this entity signs'.
💡 Root CAs are kept in 'Offline' Hardware Security Modules (HSMs) and are only powered on in highly secure ceremonies to sign Intermediate CAs. They are never used to sign end-user websites directly.
The output shows a chain. The site certificate (leaf) was signed by an intermediate/root authority. The browser follows this chain upward until it hits a Root it already knows and trusts.
Root CAs create Intermediate CAs to perform the day-to-day signing of certificates. This is a security measure: if an Intermediate CA is compromised, the Root CA can simply revoke that intermediate without having to replace the Root certificate in every computer on earth.
⚠️ 'Chain Incomplete' Errors: This happens when a server sends its leaf certificate but forgets to send the intermediate certificates. Some browsers can 'fill the gap', but others will block the site as insecure.
# Command to bundle leaf and intermediate certs into a full chain
cat certificate.crt intermediate.crt root.crt > fullchain.pem| Type | Signed By | Stored In | Purpose |
|---|---|---|---|
| Root CA | Self-signed | OS Trust Store | Anchor of Trust |
| Intermediate CA | Root CA | Server Chain | Issuance Buffer |
| Leaf (End-Entity) | Intermediate CA | Server | Identity of Website |
Traditionally, getting a certificate required manual identity verification and paying a fee. Let's Encrypt automated this using the ACME (Automated Certificate Management Environment) protocol. Instead of verifying legal documents, ACME verifies 'Control of Domain' through a DNS record or a file on the web server.
Short-lived certificates (90 days) are a security feature. If a certificate is stolen, it becomes useless much faster than a 2-year certificate.
Verify exercises to earn ★ 150 XP and unlock next lab level.