TechKnowSurge
CompTIA Security+ 1.4 CompTIA SecurityX 2.2 NIST 800-53 SC-17 ISC2 CISSP 3.6 CompTIA SecurityX 3.3 Cisco CyberOps Associate 2.11 ISC2 CISSP 4.3
TechKnowSurge Catalog Videos Certificate Hierarchy
VideoSecurityFree

Certificate Hierarchy

Public Key Infrastructure uses certificate hierarchies to establish chain-of-trust verification, connecting root certificates through intermediate certificates down to end-entity certificates used by websites and services. This process allows clients to cryptographically verify that they are communicating with a legitimate, trusted source.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Public Key Infrastructure builds on two core trust models to enable secure, verifiable communication across networks. Third-party trust relies on a mutually recognized certificate authority to vouch for the identities of communicating parties — if both parties trust the certificate authority, trust between them follows. Hierarchical trust structures that authority as a chain, where a top-level entity passes trust downward through successive levels, each inheriting and extending the credibility of the one above it. PKI applies both models together through a layered certificate architecture. The root certificate sits at the top of the hierarchy and functions as the ultimate trust anchor. Because it is so critical, it is protected carefully, and much of its day-to-day trust is delegated through intermediate certificates. Intermediate certificates, also called subordinate certificates, can be issued by the same certificate authority or by a separate organization granted partial authority. They add a security buffer between the root and the certificates used in production. End-entity certificates are the certificates actually deployed on websites and services, carrying the public key that clients use to verify and decrypt communications from that specific source. Validation works as a chain reaction: a client uses the root certificate's public key to verify the intermediate certificate's fingerprint, then uses the intermediate certificate's public key to verify the end-entity certificate's fingerprint. If each decryption succeeds, the entire chain is confirmed valid. In practice, a website like TechKnowSurge.com delivers both its end-entity certificate and the intermediate certificate to connecting clients, while the root certificate is already pre-installed on the client's machine. The chain can extend beyond three levels by including multiple intermediate certificates, though the verification logic remains the same at every step.

What you'll learn

What's covered

PKI Certificate Hierarchy

Aligned to

CompTIA Security+
1.4 Explain the importance of using appropriate cryptographic solutions.
CompTIA SecurityX
2.2 Given a scenario, implement appropriate PKI infrastructure solutions.
3.3 Given a scenario, implement the appropriate PKI solutions.
NIST 800-53
SC-17 Public Key Infrastructure Certificates
ISC2 CISSP
3.6 Select and determine cryptographic solutions
4.3 Implement secure communication channels according to design
Cisco CyberOps Associate
2.11 Identify the certificate components in a given scenario

Key terms

Public Key Infrastructure
PKI
A framework of hardware, software, policies, and standards used to create, manage, and distribute digital certificates.
Certificate Authority
CA
A trusted entity that issues digital certificates used to verify the identity of individuals, organizations, or devices.
Digital Certificate
An electronic document that uses a digital signature to bind a public key with an identity.
Public Key
A cryptographic key that can be shared openly and is used to encrypt data or verify digital signatures.
Private Key
A secret cryptographic key used in asymmetric encryption to decrypt data or create digital signatures.
Root Certificate
The self-signed certificate at the top of a PKI hierarchy that serves as the ultimate anchor of trust for all subordinate certificates.
Intermediate Certificate
A certificate issued by a root CA that passes trust down to end-entity certificates, adding a layer of security by keeping the root CA offline.
End-Entity Certificate
The certificate issued to a specific service or website that end users verify to confirm they are communicating with a legitimate source.
Chain of Trust
The linked sequence of trust relationships that connects an entity back to a trusted anchor, validating each step in the hierarchy.
Certificate Signing Request
CSR
A Certificate Signing Request is a block of encoded text containing an applicant's public key and identity information, submitted to a Certificate Authority to request a signed digital certificate.

Topics

Pki Certificate Hierarchy Chain Of Trust Root Certificates Intermediate Certificates Cryptography

Transcript

When it comes to public key infrastructure, we apply those trust models. We are going to look into what those trust models look like when it comes to certificates, and how we create this hierarchy of certificates.

I'm going to start out with just a brief overview of that third-party trust and hierarchy trust. Then we're going to get into certificates and what those certificates look like: the root certificate, the intermediary certificates, and the end entity certificate.

Third-party trust and hierarchy trust

If two entities want to communicate back and forth and establish some sort of trust, a third-party trust would be some sort of third party that would help in that process of verification, of creating that trust. And as long as one user trusts, in this case, the certificate authority, and that certificate authority trusts these servers right here, then this user will trust those servers.

Public key infrastructure also utilizes a hierarchy trust. That is, there is some sort of top level trust, and that trust gets passed down from entity to entity. And so we're going to actually apply that to public key infrastructure.

The certificates

So let's take a look at different certificates. First of all, we have a root certificate. The root certificate sits at the top. That becomes the anchor of trust that proves everything else. And so here is the root certificate. The root certificate really is key to all of the trust that happens within this hierarchy right here. So we really want to put some safeguards in place.

And one way that we might want to do that is by creating intermediate certificates instead. It can create an extra layer of security, but also with it, this could be a separate entity. And so if this certificate authority wanted to pass on some of its trust to another entity, then you would need something like an intermediate certificate. But it wouldn't necessarily need to be a separate entity either. There could be the same certificate authority that wants to create an intermediate certificate in order to create that level of security.

So how can we trust this intermediate certificate? How can we verify that it's to be trusted? Well, if the public key can decrypt this fingerprint accurately, then we know that this certificate is good, and therefore we can trust this intermediate certificate.

Then there's an end entity certificate. The end entity certificate is what we're going to actually use on the service. So in this example right here, we're going to apply this end entity certificate for the TechKnowSurge website, and then that's going to be what's used on that website to verify that it's coming from the correct source.

The verification process

So what does the verification process look like for this? Well, what's going to happen is, if we can use the public key from the root certificate to decrypt the fingerprint from the intermediate certificate, then we know that the intermediate certificate is valid. Then we can take the public key of the intermediate certificate and decrypt the fingerprint of the end entity certificate, and if that does that correctly, then we know that this certificate is valid.

So let's take a look at what that looks like in application. Now, here at the top we have our root certificate authority. The certificate authority that's at the top, it has a private key, that it also has a matching public key on a certificate that's already installed on the user's machine. From there, an intermediary certificate was generated for this intermediary certificate authority right here, and we also call that a subordinate. So this is a subordinate right here that has its own private key right there. All these private keys are kept private.

Same thing, the TechKnowSurge website also has its own private key and has submitted a CSR to get a certificate that has specifically for the techknowsurge.com, that has the public key on it. When the TechKnowSurge website downloaded the certificate and installed it on the machine, it also installed the intermediate certificate as well. So it has two certificates that are on it.

Now what happens is, when the user goes and connects to this machine, it will actually download both the intermediate and the TechKnowSurge certificate. Now that user has both of those certificates plus the root certificate. It can use the root certificate public key to verify the fingerprint by decrypting that fingerprint and verifying the intermediate certificate, and using that public key to decrypt the fingerprint of the techknowsurge.com certificate. And therefore now it knows that this techknowsurge.com certificate is verified, and can use the public key now to decrypt information coming from the official techknowsurge.com website.

One thing to note is that there are three levels with our example right here, but we could actually have multiple intermediate sites. So this could actually extend beyond just three levels.

Recap

We started out with just a quick review around a third-party trust and a hierarchy trust, and really we applied those then to the certificates: what is a root certificate, what is an intermediary certificate, and then what is an end entity certificate. And we use all of this for verifying each step along the way, to make sure that when we're getting to the end entity — or techknowsurge.com was our example — when we get to it, we can verify the source to make sure that we're getting the accurate information from the correct source.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →