Knowledge Base
Home 
 
/
 Understanding the SSL Certificate Chain: Root and Intermediate Certificates
Categories: Security

Understanding the SSL Certificate Chain: Root and Intermediate Certificates

Important: This article applies to customers with SSL services only.

This article explains the details of the SSL certificate chain, including the difference between root and intermediate certificates and how they work together to secure your website. Understanding this hierarchy is key to diagnosing certain SSL/TLS issues.

In this article, we'll cover:

What are Root and Intermediate Certificates?

A 'root' certificate is a certificate that is self-signed (meaning its Subject and Issuer are the same) and is included by default in the trusted root store of operating systems and browsers. An 'intermediate' certificate acts as a bridge of trust between the root certificate and your server's SSL certificate, completing the SSL certificate chain.

There are three main root certificates commonly involved in these chains:

Because the newer SHA-2 roots (USERTrust, COMODO) haven't been trusted by all platforms for as long as the older AddTrust root, 'cross-certificates' were created. These are versions of the newer roots that were signed by the older, more widely trusted AddTrust root. For example, see the USERTrust RSA CA being signed by AddTrust: https://crt.sh/?id=4860286.

A Note on SHA-1: While the AddTrust CA root uses the SHA-1 algorithm, it does not pose a security risk in a root certificate. The known vulnerabilities with SHA-1 relate to creating new, fraudulent certificates (collisions), not validating existing ones. Major root programs trusted these chains until their natural expiration.

 

The AddTrust Root Expiration (May 2020)

Modern clients (browsers, operating systems) are unaffected by the AddTrust root's expiration. Their path-building logic simply ignores the expired cross-certificate and builds a valid SSL certificate chain directly to the newer, trusted SHA-2 root (COMODO or USERTrust) that is already in their trust store.

The only clients that could have problems were very old, end-of-life devices that trusted the AddTrust root but never received updates including the newer COMODO/USERTrust roots. For these legacy systems, the entire SSL certificate chain would fail validation after May 2020.

Note: For more information, please see AddTrust Root Expiration.

 

Visualizing the Trust Chain Paths

Note: When the AddTrust External CA Root expired, Trust Chain A became obsolete for modern clients. They now automatically validate using Trust Chain B. No action is required by customers for this to happen.

Below is a diagram showing the two potential trust paths. Certification path validation is done automatically on the client-side.

Trust Chain Path A (Legacy):

  • AddTrust External CA Root [Root]
  • USERTrust RSA Certification Authority [Intermediate 2]
  • RSA DV/OV/EV Secure Server CA [Intermediate 1]
  • End Entity [Your Website's Certificate]

Trust Chain Path B (Modern):

  • USERTrust RSA Certification Authority (Root CA) [Root]
  • RSA DV/OV/EV Secure Server CA [Intermediate 1]
  • End Entity [Your Website's Certificate]



Diagram of SSL Certificate Trust Chain A


Diagram of SSL Certificate Trust Chain B
 

 

Related Intermediate Certificates:

Attachments:

  1. Comodo Chain of Trust 1/31/2020
  2. Chain_Hierarchy 1/31/2020

 

Review

This guide has detailed the structure of an SSL certificate chain, explaining the distinct roles of self-signed Root CAs and the Intermediate CAs that connect them to your website's SSL certificate. We also covered how the expiration of older roots like AddTrust was handled through cross-certificates and modern client logic, which automatically finds a valid trust path. Understanding this hierarchy helps clarify how browsers and devices validate the security of your website.

Back to Top ↑