3 ms·
Isn't that the point of having the root cert and the intermediate? Otherwise, why not just have everything keyed to the root?
by rossdavidh 8y ago
Isn't that the point of having the root cert and the intermediate? Otherwise, why not just have everything keyed to the root?
- rndgermandude 8y agoBecause a root typically has a longer expire date and thus has to be stored extra secure and handled extra safely. You'd usually store it in some hardware security module that is operated by an airgapped system or something like that that requires physical access at the very least. Replacing the root often requires shipping new versions of your software that disables the old root and bakes in a new root. If an intermediate certificate becomes compromised, you can revoke it and issue a new intermediate certificate with your still secure root without the need to push out new binaries.