You Can't Trust a Leaf Certificate

The past year I’ve been working a lot with certificates and trust management, which can, sometimes, yield its own fun stories and learnings. Here’s one: say you’re given a leaf certificate and its intermediate, but not the root. Which one do you trust? Trusting the leaf may look reasonable, since that is the certificate they sign with, but it defeats the whole purpose of a trust anchor. For those who’ve worked with X.509 certificate management, you know what the problem is, and feel free to skip the whole post. However, I wanted to write a short post on why you can’t just trust a leaf certificate. X.509 works with certificate chains. A certificate chain is a… chain of certificates where each certificate is signed by its issuer, the certificate above it. Usually, a CA has a root certificate, and issues intermediate CA certificates, which in turn issue leaf certificates from there on. You trust the CA, and therefore, trust all the certificates under it. The first problem with trusting a…

Commenting on Bubbles has been removed. Why? If you want to talk about this post, write to the author, use the comments on their blog if it has them, or reply with a "RE:" post on your own blog. Suggestions? feedback@bubbles.town