x509certificatetls1.2trust

How does the TLS client handle two copies of an intermediate certificate


The TLS server is configured to send the leaf and intermediate certificates on TLS handshake. The TLS client will validate the trust-chain of the server leaf certificate with the help of intermediate and root certificates. The root certificate must exist local on the client, the server leaf certificate must be sent from the server. However if the intermediate certificate exists locally on the client and is sent from the server - in this case there are two copies of the intermediate certificate available to the validation process. Which copy of the intermediate certificate will be chosen to be used to validate the chain of trust?


Solution

  • It depends on specific implementation of certificate chaining engine and is outside of TLS scope. Certificate chaining engine constructs as much chains as it can by using all available information. After building all chains, CCE eliminates duplicate ones, then based on internal algorithm, selects the best chain which is used for further operations.

    There might be a case when local intermediate certificate is better than the one received from TLS handshake. In this case, intermediate certificate received from TLS is not used.