The chain of trust right back to the root

The authorities almost never sign website certificates directly. They use intermediaries, forming a chain.

The structure

[Racine]              (self-signed, in the trusted store)
    |
    | (sign)
[Intermediaire]
    |
    | (sign)
[exemple.com]         (site certificate)

Your browser traces this chain: it checks that the site’s certificate is signed by the intermediary, that the intermediary is signed by the root, and that the root is in its trust store.

The Trust Anchor

The root certificate is self-signed: it signs its own certificate. Mathematically speaking, this proves absolutely nothing.

Its value does not stem from the signature but from its presence on your system, installed with your browser or operating system following an audit. This is the trust anchor, the point at which verification stops.

Your computer contains around a hundred of them, belonging to organisations and governments from all over the world. You can view the list in your browser’s settings — it’s an eye-opening exercise.

Why intermediaries?

This indirect approach exists to protect the root. Its private key is kept offline, in a safe, and is used only very rarely. A compromised root would be a disaster: it is present in billions of devices and cannot be replaced quickly.

A compromised intermediary, on the other hand, can be revoked without affecting the root.

The structural flaw

Here’s the crucial point: any certificate authority can issue a certificate for any domain.

There are no barriers. A certificate authority in any country can technically issue a valid certificate for your bank, and your browser will accept it.

The security of the whole system is therefore only as strong as its weakest link, amongst around a hundred organisations. This is not just a theoretical risk: in 2011, the Dutch certificate authority DigiNotar was compromised and fraudulent certificates were issued for Google domains, which were then used against Iranian internet users. DigiNotar was removed from all browsers and went bankrupt shortly afterwards.