Summary
Offline root CA, operational intermediate CAs and impact on chain depth.
Definitions
This article introduces PKI hierarchy: root and intermediates in an educational way. Keywords: root, intermediate, cross-sign.
- Object — what the mechanism protects or attests (integrity, authenticity, confidentiality, trust).
- Actors — issuer, subject, verifier, and any authority involved.
- Artefacts — certificates, tokens, lists, logs, reports.
How it works
- Identify the trust need (who must prove what to whom).
- Choose the right mechanism (certificate, signature, TLS, timestamping…).
- Produce or obtain the required artefacts.
- Publish / install / present the artefacts to the verifier.
- Verify (chain, validity, revocation, policy) before granting trust.
Examples
- HTTPS server presenting a complete TLS chain up to an anchored root.
- Signed PDF document (PAdES) verified locally, then optionally via an independent validator.
- Local inventory of machine certificates to detect expirations (Windows).
Summary tables
| Question | Typical answer |
|---|---|
| What is proven? | Depending on the mechanism: server identity, document integrity, non-repudiation… |
| Who can verify? | Any verifier that has the required trust anchors / policies. |
| What expires? | Often the certificate / token — not necessarily the document itself. |
Good practices
- Document trust anchors and their renewal.
- Separate test and production environments.
- Log issuances, installs and revocations.
- Do not expose private keys in repositories or tickets.
Common errors
- Incomplete chain (missing intermediates).
- DNS name outside the SAN.
- Confusing encryption with signature.
- Presenting an undelivered product capability as available.
FAQ
Frequently asked questions are gathered on the dedicated page: Read the FAQ.
Definitions: glossary · certificate · TLS · PKI · EviDNA.
Glossary
The site’s terminology reference is the CertiShielder™ glossary (stable anchors).
Further reading
Continue with the official sources below, then the related articles. The glossary clarifies terms; the FAQ covers edge cases. The goal is not to close the topic, but to open a useful next step.