Cryptology Academy · Lesson

Certificate Authorities & Trust Chains

Learn root CAs, intermediate CAs, and how browsers verify certs.

Lesson 2 of 413 steps

Certificate Authorities & Trust Chains is a free Cryptology Academy lesson on CoddyKit. This is lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cryptology Academy learning path, and your progress syncs across the web and the CoddyKit app. The Cryptology Academy course includes 4 lessons in total.

Welcome

Certificate Authorities are the trust anchors of the internet. In this lesson we trace how root CAs, intermediate CAs, and leaf certificates form a chain of trust.

Root CA

A root CA is self-signed: Issuer == Subject. Root CA private keys are kept offline in HSMs in multiple secure facilities. There are ~150 root CAs trusted by major browsers.

Root CA Trust Stores

Browsers and OS maintain a list of trusted root CA certificates. Chrome uses Google's Root Store. Firefox has its own. macOS/Windows use OS trust stores. Mozilla's is publicly audited.

Intermediate CA

Root CAs sign intermediate CA certificates. Intermediate CAs do the actual certificate signing. This way root CA private keys stay offline. Compromise of an intermediate doesn't expose the root.

Certificate Chain

leaf cert (your.domain.com) → signed by Intermediate CA → signed by Root CA → self-signed (trust anchor) Browsers verify each signature in the chain up to a trusted root.

Chain Verification Algorithm

1. Check leaf cert signature with intermediate CA public key. 2. Check intermediate cert signature with root CA public key. 3. Check root CA is in trust store. 4. Check validity periods. 5. Check revocation status.

Domain Validation (DV) vs OV vs EV

DV: CA only verifies domain control (automated). OV: verifies organization identity (manual review). EV: enhanced verification, formerly showed company name in browser bar. Let's Encrypt issues DV only.

Let's Encrypt ACME Protocol

ACME automates DV certificate issuance: 1. Client requests cert for domain. 2. CA issues a challenge (HTTP-01: serve a token at /.well-known/). 3. Client proves control. 4. CA signs and returns 90-day certificate.

Certificate Pinning

Apps pin specific certificate or public key hashes. If the server presents a different cert (even CA-signed), the connection fails. Prevents CA compromise attacks but makes rotation difficult.

CA Compromise: DigiNotar 2011

DigiNotar was compromised, issuing fraudulent certs for Google.com. Iran used them for man-in-the-middle attacks on users. DigiNotar was removed from trust stores, ceasing operation immediately.

Certificate Transparency (CT)

CT logs are public append-only Merkle trees of all issued certificates. CAs must submit certs before issuance. Browsers require SCTs (proofs of CT log inclusion). Enables detecting mis-issued certs.

Quick Check

Why do root CAs use intermediate CAs rather than signing leaf certificates directly?

Answer it in the interactive lesson

Recap

CA trust chains are now clear! Next we study how compromised certificates are revoked via CRL and OCSP.

Free to start

Learn Cryptology Academy with an AI tutor — free

Write and run real code in your browser, get instant help from a 24/7 AI tutor, and pick up where you left off on the web or in the app.

Courses: 67
Lessons: 261

Start learning free View the full course

Frequently Asked Questions

Is the “Certificate Authorities & Trust Chains” lesson free?

Yes — the full text of “Certificate Authorities & Trust Chains” is free to read here on the web. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cryptology Academy course, upgrade to CoddyKit PRO. The Cryptology Academy course includes 4 lessons in total.

What will I learn in “Certificate Authorities & Trust Chains”?

Learn root CAs, intermediate CAs, and how browsers verify certs. You practise Cryptology Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cryptology Academy?

No prior experience is required. Cryptology Academy on CoddyKit is structured for beginners through advanced learners, so you can start here or from the beginning and move at your own pace. This is lesson 2 of 4.

How long does the “Certificate Authorities & Trust Chains” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cryptology Academy lesson?

Yes. Every Cryptology Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Cryptology Academy