4 ms·

Thanks. But this is where my confusion is. I am wondering whether the certificate installed on the web server was signed by Let's Encrypt root or some intermedi

by ssd532 3y ago

Thanks. But this is where my confusion is. I am wondering whether the certificate installed on the web server was signed by Let's Encrypt root or some intermediary (may be another let's encrypt entity). It was issued and installed using standard let's encrypt tooling for Ubuntu.

agwa 3y ago
It was signed by a Let's Encrypt intermediate. Roots are not allowed to sign website certificates. And that's why your server needs to also send the intermediate certificate - so that clients can construct a chain of signatures from your website certificate to the root that is installed in the OS trust store.
- ssd532 3y ago
  Ah, got it now. Thanks.
- tialaramex 3y ago
  [Andrew knows this but for the benefit of others] This (the fact all end entity certificates are signed by an Intermediate, never a root) is a policy of the Web PKI rather than being inherent to any conceivable system for such a purpose or to the X.509 technology in particular. Specifically the roots aren't allowed to be online by policy. So you can't use them to issue end entity certificates, when they do sign things (notably to create new Intermediates) that's a supervised activity, several humans (perhaps an officer from the organisation which owns the root, plus somebody representing their third party auditor, plus a technician to do the actual work) are typically physically present overseeing the signing process. The rest of the time the roots might live in a safe in somebody's office, that sort of thing. This sort of safeguard means even catastrophic IT failures should only result in a compromised Intermediate. Still not good, but recoverable without needing to co-ordinate large numbers of third parties or greatly annoy the Relying Parties (ordinary people).