4 ms·
This was a performance decision. Cross-signing the root instead of the intermediate would mean that web servers would have to include both the root and the inte
by j4cob 11y ago
This was a performance decision. Cross-signing the root instead of the intermediate would mean that web servers would have to include both the root and the intermediate in the chain they serve, rather than just the intermediate. That would add a full packet to each handshake.
- Natanael_L 11y agoWhy are there multiple intermediate certs? I don't know the details of the standard procedure.
- vog 11y agoIn case the main intermediate cert has been compromised and must be revoked, the alternative intermediate cert is already signed and can be used immediately for desaster recovery.