A server certificate is validated through the chain Root CA certificate → intermediate CA certificate → server certificate. What is each certificate called, how many signatures must be checked at minimum, and what makes the chain trustworthy?
Root CA (self-signed, the trust anchor) → intermediate or issuing CA → end-entity certificate. At least two signatures are checked: the one on the intermediate and the one on the server certificate. Trust rests on the root being installed as a trust anchor.
The three roles:
| Certificate | Names | Signed by |
|---|---|---|
| 1 | Root CA certificate, self-signed certificate, trust anchor | itself |
| 2 | Intermediate / issuing CA certificate | the root CA |
| 3 | End-entity certificate (here a server/computer certificate) | the intermediate CA |
What gets verified: the signature on certificate 3 is checked with the public key in certificate 2, and the signature on certificate 2 with the public key in certificate 1. That makes two signatures. The root's self-signature proves nothing by itself, since anyone can sign their own certificate.
Why the root is trusted: it is stored in the operating system or browser as a trusted root CA, which makes it the trust anchor. Validation always ends there.
Installing a new root by hand: before accepting an unknown root CA certificate, compare its fingerprint (a hash of the certificate) with the fingerprint from an independent, trustworthy source, such as the CA's website or a phone call. Otherwise an attacker could slip in their own root and every certificate they issue would look valid.