EMZETT.
Login

Emzett Wiki

Certificate chain and PKI: How trust arises on the internet

Properties1
tagsglossar, krypto, tls

2 min read

Certificate chain and PKI: How trust arises on the internet

In short: A browser trusts a web server because its certificate is signed via a chain up to a root certificate authority trusted by the operating system or browser.

In more detail: How can your browser be sure that bank.com really is the bank? Through a public key infrastructure (PKI): a system of certificates, certificate authorities (CA) and verification rules that binds public keys to identities.

In Depth

The chain

A web server certificate (end-entity/leaf) contains domain, public key, validity and the signature of a CA:

Root CA (preinstalled in browser/operating system)
   └─ signs → Intermediate CA
        └─ signs → server certificate (bank.com)

The browser checks: signature of each link, validity period, matching domain name, revocation (CRL/OCSP) and whether the chain ends in a trusted root. Roots are rare and strongly protected (offline, HSM); day-to-day operation runs via intermediates, which are easier to replace if compromised.

Where trust comes from

Operating systems and browsers ship trust stores with root certificates (Mozilla, Microsoft, Apple, Google). CAs must meet audits and rules of the CA/Browser Forum. Certificate transparency (CT): all issued certificates are recorded in public logs so that domain owners discover mis-issuance (for example via crt.sh).

Typical errors

  • ERR_CERT_AUTHORITY_INVALID: chain not trusted (self-signed, missing intermediate certificate on the server).
  • ERR_CERT_DATE_INVALID: expired or wrong system clock.
  • ERR_CERT_COMMON_NAME_INVALID: domain does not match the certificate.
  • Revoked: key compromised. Solution on the server side: configure the complete chain (leaf + intermediate), renew in time (automate Let’s Encrypt).

Own PKI and practice

In companies and home networks internal CAs are used (for example step-ca, Windows AD CS, mkcert for development): the root certificate is installed on the devices. Caution: whoever installs a foreign root can decrypt all TLS traffic (company proxy, malware). Certificate pinning and HSTS increase security. Certificate types: DV (domain), OV (organisation), EV (extended validation, hardly visible today).

See also: Certificate authorities, Let’s Encrypt, TLS handshake in detail, ERR_CERT_DATE_INVALID