Digital certificates and certificate hierarchies come to life through a browser-based walkthrough of a real-world SSL certificate chain, from end-entity certificate to intermediate CA to root certificate. The demonstration also covers how root certificates are pre-installed on operating systems and managed through tools like Certificate Manager.
Digital Certificates in Real Life
Let's take a look at what those digital certificates look like and what the hierarchy looks like in real life.
First a quick summary of what we talked about previously, just so we have that context. We're going to be going to the TechKnowSurge website, which is going to have an end entity certificate on it, or a techknowsurge.com certificate on it. It's also going to be associated with an intermediate certificate and a root certificate. So that root certificate is going to use its public key to decrypt the fingerprint of the intermediate certificate to verify the intermediate certificate. And then once that's verified, the public key of the intermediate certificate will decrypt the fingerprint of the end entity certificate, or the techknowsurge.com certificate. Once a user verifies the intermediate and techknowsurge.com certificates using the root certificate, then what will happen is that any information that's coming from these servers that's been encrypted with this private key can be decrypted by the techknowsurge.com public key found in the certificate, therefore validating that it's coming from the correct source and has not been changed en route.
So here I have a browser open and it's connected to the TechKnowSurge website. I'm going to open up the certificate that it's got. So I'm going to click on this lock right here, go down to the connection is secure, and click that certificate is valid, and I'm going to open up the certificate.
Here's the certificate. When we have this open, we first of all see that there's this General tab, which gives us some general information such as which site is this validating. It's the techknowsurge.com website. What is the organization it's coming from: Let's Encrypt. So that's that intermediary certificate right there, or R3, and we're going to get a little more into that. It also has a validation period, so when does the validation period start and when does it end, when does it expire. It also tells us what the algorithm was used to create the fingerprint here, and what those fingerprints are for both the public key and the certificate.
We also have this Details tab, which gives us some of the same information but also other information, things like the version number. So it has the version number on there. Here again it's got the issuer on here. If we scroll down we see the public key, so this is the actual public key that's associated with this certificate right here.
So a lot of cool information in here, but what I really wanted to point out here is the certificate hierarchy. We have the techknowsurge.com here that was issued from the intermediate, which is R3, which was issued from ISRG Root. So this is the root of all of this, the root certificate. And we're going to take a look at that root certificate, which is going to verify the intermediate certificate, which is going to verify the techknowsurge.com certificate.
Next what I want to do is open up the cert manager and actually look at this root certificate. I've mentioned several times that that root certificate is actually installed on your computer already, and you can view what those are. I'm going to click on Windows right here and type in cert manager, and it will pop up. We've got the UAC there, and here is what's managing all of the certificates on the machine. This is where, if I wanted to trust a machine directly, I could actually install it through this interface right here and then be able to trust something directly or indirectly.
I want to show you this: if I look at the trusted root certificate authorities, take a look at the certificates, I'm going to scroll down, and what I'm looking for is the ISRG Root X1. It's the same one that shows up on my techknowsurge.com certificate. I'll open that up and it looks very similar. The interface is a little different, but it's got this General tab which gives some information on it. It also has some details. I can scroll through these details, and one of the things that it gives me is the public key, so there's the public key for this certificate.
So it's really cool how this all works. This public key certificate is what starts all of the verification process, to make sure that this techknowsurge.com certificate is valid and therefore the traffic coming from the techknowsurge.com website is valid as well.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →