3 ms·

If you create your own CA it's not trusted by your browser. Intermediate chains have nothing to do with it because at the end of the chain is no trust.

• lmm 9y ago
  Plex became an intermediate CA, not a root CA, right? Or did I misunderstand?
  • dalore 9y ago
    Small misunderstanding. The browsers have a list of CA's they trust. Let's call them the root CAs. You normally won't get a http cert signed by a root CA, it's normally done by an intermediate CA. Now your browser doesn't that, but it's been signed by a root CA so your browser eventually trusts it. You get your server to also serve the intermediate CA certs to save a round trip for requesting it. But in the end, because it's the chain of trust, your browser trusts it because it's eventually signed by a trusted root CA. Now if you create your own CA you will need to be installed in the users browsers to trust. Even if you put the intermediate certificates as your browser can't establish a link of trust.
    • lmm 9y ago
      > Now if you create your own CA you will need to be installed in the users browsers to trust. Even if you put the intermediate certificates as your browser can't establish a link of trust. If you create your own root CA you will need to be installed in the user's browsers to trust. If you create your own intermediate CA then you only need for your CA's certificate to be signed by an existing root CA.
      • dalore 9y ago
        Yep that's right