What Is an Intermediate Certificate Authority?
An intermediate CA is a link in a certificate chain, also called a chain of trust:
An intermediate certificate authority (intermediate CA) is a certificate authority whose own certificate is signed by a root CA (or by another intermediate), and which then issues certificates to websites, services, people or software publishers. Clients trust a certificate from an intermediate because they can follow the signatures back to a root they already trust.
Why intermediate CAs exist#
- Protecting the root key. Root keys are hard to replace, because every trust store would need updating. Keeping them offline and issuing day to day from intermediates limits how often the root key is used.
- Separating purposes. CAs often run different intermediates for TLS, code signing, email (S/MIME) and validation levels such as DV, OV and EV.
- Limiting blast radius. If an intermediate is misused, it can be revoked without replacing the root.
- Cross-signing. An intermediate can be signed by more than one root (a cross-sign), so certificates it issues are trusted by clients that only know one of those roots. Both copies of a cross-signed intermediate share the same public key.
What happens when an intermediate key is compromised#
An intermediate CA is trusted for whatever its certificate allows. For a public TLS intermediate, that usually means any domain name. If its private key is stolen or turns out to be weak, an attacker can issue certificates that clients will accept for sites the attacker does not own, and use them to impersonate those sites or intercept traffic.
Defenders then need clients to stop trusting the intermediate:
- Revocation through CRLs or OCSP, which only works for clients that check it.
- Browser push lists such as Chrome CRLSets and Mozilla OneCRL/CRLite, which reach browsers within hours.
- Trust store and library updates for operating systems, language runtimes, container images and bundled CA files, which reach software only when someone ships and deploys an update.
The October 2026 eMudhra intermediate CA compromise is a current example: browsers were protected quickly, while servers and SDKs needed patched trust stores.
Intermediate CA vs root CA#
| Root CA | Intermediate CA | |
|---|---|---|
| Signed by | Itself | A root CA or another intermediate |
| Stored in client trust stores | Yes | Usually no; sent by the server in the chain |
| Key usage | Rare, typically offline | Frequent, issues leaf certificates |
| Replacing it | Requires trust store updates everywhere | Revoke and issue a new intermediate |
When you will encounter intermediate CAs#
- TLS misconfiguration: a server that does not send its intermediate certificate causes “unable to get local issuer certificate” errors in some clients.
- Certificate inspection:
openssl s_client -showcertslists the chain a server sends, including intermediates. - Incident response: CA incidents are usually announced by intermediate name, fingerprint and SPKI hash, which you match against your own certificates and trust stores.
- mTLS: internal PKIs commonly issue client certificates from a private intermediate.