The more I refresh my understanding the more confused I get.
Say I have example.com and it’s time I update the SSL cert for that site. I have my private key, but then I end up downloading what appears to be a crt bundle and a csr. What is the difference between these?
CA bundle is a file that contains root and intermediate certificates. What are these two certificates types? How do they work in concert with SSL?
What is the base level of “new files” I would need, basically, to renew my certificate? It’s still not clear to me.
Are the root certs for example certificates that sit on my local machine for various things? I see them in different Windows and Linux and Mac hosts.
In: 5
A certificate contains a domain name (or some other identifier), “the subject”, a public key, and a signature over that name and key made using a private key for which there is some other certificate “the issuer”. A valid certificate has a chain of certificates, such that for each subject you have an issuer certificate, for which you have an issuer certificate, and so on up until eventually you end up at a “root certificate” which you trust absolutely.
The original idea was that browsers would have a set of root certificates, and those root certificates would directly sign end-user certificates. But there are good reasons why that’s not ideal: having the key matching that root certificate available to sign things exposes it to risk, and compromise of that key is very serious. Those certificates need to have very long lifetimes, too.
So now, there are a chain of intermediate certificates, either one or two deep, between the root certificate and the certificate you are issued by a CA. So your LetsEncrypt certificate is (currently) issued by R3, which your browser probably doesn’t trust, but that is in turn signed by ISRG, which your browser does. So if you were just presented with a certificate signed by R3, you’d reject it: you don’t know anything about the intermediate certificate. Instead, you are handed both the R3 certificate and the subject certificate, so you can trace the path back to a certificate you do know about.
In general, a website (or whatever) needs to serve the certificate covering its name, but also any intermediate certificate which a client may need to trace to a root certificate.
Latest Answers