Search code examples
ssl-certificateazure-appservice

Merging intermediate certificates

I'm having a reading of this documentation on certificates in Azure App Service, and having trouble understanding this sentence, regarding the meaning of merging intermediate certificates:

If your certificate authority gives you multiple certificates in the certificate chain, you have to merge the certificates following the same order.

What is the purpose of CA giving multiple certificates in the certificate chain, if ultimately you have to merge them? Why not giving only one?

On the other hand, someone already holding multiple certificiates, why would they want to merge them, and not making use of them for multiple purposes?

Solution

  • By default each certificate is untrusted. If untrusted certificate signs another certificate then both are untrusted.

    But there are self signed certificates issued by root certification authorities that are trusted.

    These are installed in each computer. In windows you can view them in certmgr.msc

    Press the Windows key + R to bring up the Run command, type certmgr.msc and press Enter.

    enter image description here

    These are certificates that are trusted.

    Consider situation when some trusted certificate from Root CA "A" (for example) signs another certificate "B" and then "B" certificate signs "C" certificate.

    Then "C" - "B" - "A" are creating chain of trust. "C" references "B" and "B" references "A"

    "C" certificate is trusted only if "B" certificate is included. It's not enough that "C" certificate is signed properly. "B" certificate must be included to prove it.

    That's reason why you have to merge certificates.

    ("A" certificate is not necessary in merge because it is from Root CA and is already stored in each PC)