PKI & Certificate Chain
Security
Overview
A leaf certificate chains through intermediates to a trusted root. Signature checks, validity, hostname and intended use all matter; revocation handling depends on policy and mechanism. Private keys must remain protected. Importing an arbitrary root can authorize untrusted issuers.
Protocol stages
- 1Leaf
- 2Intermediate
- 3Trusted root
- 4Time/name/use checks
Interactive exercise
Knowledge check
A leaf and intermediate are unexpired but the root is not in the client trust store. What is missing?
Educational model — not real hardware, traffic or official certification.