Contents
What is the purpose of the intermediate CA certificate?
All major Certificate Authorities use intermediate certificates because of the additional security level. This helps to minimize and compartmentalize damage in the event of a mis-issuance or security event.
What is an intermediate SSL certificate?
An intermediate certificate is a subordinate certificate issued by the trusted root certificate authority and provided to certificate providers to give them the authority to issue end-entity (SSL) server certificates.
How do I get an intermediate certificate for SSL?
One of the simplest ways to find the intermediate certificate and export it is through an Internet Browser such as Google Chrome. Browse to the website that you need to get an intermediate certificate for and press F12. Browse to the security tab inside the developer tools. Click View certificate.
Why do I need to add intermediate CA certificates to JVM’s certificate store?
Since the “Company Issuing CA Intranet Server” is signed by “Company Root CA”, and since I have “Company Root CA” in the list of certificates trusted by JVM, why did I need to additionally add the “Company Issuing CA Intranet Server” certificate to the certificate store of JVM?
How are intermediate certificates used in certificate discovery?
As part of certificate path discovery, the intermediate certificates must be located to build the certificate path up to a trusted root certificate. An intermediate certificate is useful to determine if a certificate was ultimately issued by a valid root certification authority (CA).
How to validate intermediate certificates in the server?
To complete this certificate validation successfully, the intermediate certificates in the server certificate chain must be configured correctly on the server. Otherwise, the server authentication may fail. It also applies to any program that uses SSL or Transport Layer Security (TLS) for authentication.
What to use instead of cacerts In JSSE?
This will leave the original cacerts file available as a backup. JSSE will use the jssecacerts file, if present, instead of cacerts. Jssecacerts needs to start as a copy of cacerts, which it overrides rather than extends.