![\"Root](\"https:\/\/cheapsslsecurity.com\/p\/wp-content\/uploads\/2025\/06\/root-intermediate-certificate.png\")
<\/p>\nThey may seem similar at first glance, but their roles in the PKI are very different.<\/p>\n
<\/p>\n
Understanding the difference between root vs. intermediate certificates is key to understanding how web security works.<\/p>\n
This screenshot shows (in order), a root, intermediate, and leaf certificate:<\/p>\n
<\/p>\n
As you can see, in this case the root and intermediate certificates have similar names, so let\u2019s take a look at the differences.<\/p>\n
A root certificate is the top of the trust hierarchy<\/strong>. It is self-signed and stored in the trusted stores of operating systems and browsers. These certificates belong to root certificate authorities (Root CAs), such as DigiCert, Sectigo, or GlobalSign. The companies that operate root CAs are subject to rigorous vetting and security requirements, as one compromised root certificate can undermine the trust of many sites.<\/p>\n Intermediate certificates are created and signed by the root CA<\/strong> (or in some cases another intermediate). Their job is to act as a link between the root and the final certificates that are issued to sites. This is not just an additional link, but an important layer of protection: if an intermediate certificate is compromised, it can be revoked without affecting the root, which remains trusted by millions of devices.<\/p>\n The separation into root and intermediate certificates helps minimize risks. The root CA is not used directly to issue site certificates – it remains in deep isolation to reduce the risk of compromise. Instead, its “delegates” – intermediate CAs – sign and issue SSL certificates. This cascading delegation is called a chain of trust.<\/p>\n When you visit a site, the browser checks not only the site’s SSL certificate itself, but also the chain leading to the root. If even one link is missing or invalid, the connection will not be considered secure. Therefore, it is important for site owners to correctly configure the server, adding not only their certificate but also the entire package of intermediate certificates.<\/p>\n Here\u2019s how the chain of trust works when you visit a website:<\/p>\n When visiting a website that uses HTTPs, follow these steps to see which root and intermediate CAs issued that website\u2019s certificate:<\/p>\n The division into root and intermediate certificates is not a mere formality, but a well-thought-out security architecture. The root CA is the basis of trust, and intermediate ones are its shield and tool. Together, they create a flexible and stable infrastructure, without which the modern Internet would be vulnerable and unreliable.<\/p>\n","protected":false},"excerpt":{"rendered":" When we talk about web security, especially in the context of HTTPS and SSL\/TLS certificates, we\u2019ll often mention root and intermediate. They may seem similar at first glance, but their roles in the PKI are very different.<\/p>\n","protected":false},"author":6,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[21,4],"tags":[],"class_list":["post-2339","post","type-post","status-publish","format-standard","hentry","category-ssl-advanced","category-ssl-basics"],"yoast_head":"\nWhat Do Intermediate Certificates Do?<\/h2>\n
Why Does It Work This Way?<\/h2>\n
Chain of Trust In Practice<\/h2>\n
\n
How To See Root & Intermediate Certificates in Google Chrome<\/h2>\n
\n
![\"Root](\"https:\/\/cheapsslsecurity.com\/p\/wp-content\/uploads\/2025\/06\/root-vs-intermediate-certificate.png\")
<\/p>\nSumming Up Root vs. Intermediate CAs<\/h2>\n