Public Key Infrastructure · 4.3

🏗️ Certificate Authorities & Chain of Trust

How 150 trusted organizations secure billions of connections⏱ ~3 min

🏛️Root CApre-installed in your browsersigns ↓🏢Intermediate CAdoes day-to-day signingsigns ↓🌐example.comthe website's certificateBrowser checksthe chain UP ⬆
The chain of trust — your browser walks up the chain until it hits a root it already trusts

The Certificate Chain (Trust Chain)

Certificates are arranged in a hierarchy. Root CAs sit at the top — their certificates are self-signed and pre-installed in your OS/browser trust store. Below them are Intermediate CAs, which sign leaf (end-entity) certificates for actual websites and servers.

  1. 1.Root CA — self-signed, pre-trusted, kept offline in HSMs (hardware security modules), rarely used
  2. 2.Intermediate CA — signed by the Root CA; used for day-to-day certificate issuance
  3. 3.Leaf Certificate — signed by an Intermediate CA; presented by websites/services to clients
  4. 4.Verification: browser verifies Leaf → signed by Intermediate → signed by Root → in trust store ✓
★ FactRoot CA private keys are kept offline, often in air-gapped vaults with multi-person authorization requirements and hardware security modules (HSMs). DigiCert's root key ceremony involves multiple employees, auditors, a safe, keycards, and is filmed for compliance. Compromising a root CA key would allow issuing fake certificates for any domain on earth.

Certificate Issuance Process

  1. 1.You generate a key pair on your server
  2. 2.Create a Certificate Signing Request (CSR) containing your public key and domain info
  3. 3.Submit the CSR to a CA (e.g., DigiCert, Let's Encrypt, Comodo)
  4. 4.CA validates your identity (DV: prove domain control via DNS record or HTTP file; OV/EV: manual checks)
  5. 5.CA signs your public key and issues the certificate
  6. 6.Install the certificate on your server; configure it in your web server (nginx, Apache)

Let's Encrypt — Free, Automated Certificates

🔒 SecurityLet's Encrypt (letsencrypt.org) is a free, automated, open CA launched in 2016 by the Internet Security Research Group. It issues DV certificates valid for 90 days, auto-renewed via the ACME protocol (used by Certbot and most hosting platforms). Let's Encrypt has issued over 3 billion certificates and eliminated cost as a barrier to HTTPS adoption.
bash
# Install Certbot (Let's Encrypt client) on Ubuntu
sudo apt install certbot python3-certbot-nginx
 
# Obtain and auto-configure certificate for nginx
sudo certbot --nginx -d example.com -d www.example.com
 
# Test auto-renewal
sudo certbot renew --dry-run
 
# List installed certificates
sudo certbot certificates

Certificate Revocation

MechanismHow It WorksProblem
CRL (Certificate Revocation List)CA publishes a list of revoked serial numbers; clients download periodicallyList can be large; not real-time; clients may cache stale list
OCSP (Online Certificate Status Protocol)Client queries CA's OCSP responder in real-time for each certificatePrivacy concern: CA logs every site you visit; responder downtime breaks connections
OCSP StaplingServer fetches and caches OCSP response, includes it in TLS handshakeBest current practice: private, fast, no extra round-trip for client
⚠ WarningMost browsers fail-open on OCSP — if the OCSP server is unreachable, the browser accepts the certificate anyway. This means a CA going down does NOT protect against compromised certificates. Certificate Transparency (CT) logs and browser preloading (HSTS) provide better real-world protection.
🧠Quick Checkfirst try = +5 XP

Why are Root CA private keys kept offline?

🎮 Practice what you learned
🔓
Cipher Cracker
Break Caesar & substitution ciphers yourself
→🏰
Password Fort
See hashing & cracking in action
→
⭐ 0 XP🔥 0 days
Open the full interactive Cryptography module →