sertifikaattiketjut

Sertifikaattiketjut, known as certificate chains, are sequences of digital certificates that establish a trust path from a specific entity, such as a website or application, to a trusted root certificate authority (CA). Each certificate in the chain is issued by the one that follows it, creating a hierarchical relationship. The chain typically begins with the leaf certificate, which belongs to the entity being authenticated. Above this, one or more intermediate certificates are included. These intermediates bridge the gap between the leaf certificate and the root CA, allowing the root to sign many certificates without exposing its private key. The topmost certificate is the root certificate, which is self‑signed and distributed widely in trusted root stores of operating systems and browsers.

When a client receives a certificate chain, it verifies each link by checking the digital signature of the following certificate using the public key from the current one. The process continues up to the root, which is considered trusted if it is present in the client's trust store. If any certificate is revoked, expired, or fails signature verification, the entire chain is deemed invalid, and the client should not establish a connection. Certificate revocation checks are performed via mechanisms such as Certificate Revocation Lists (CRLs) or Online Certificate Status Protocol (OCSP). Proper certificate chain construction and maintenance are essential for secure communications, preventing attacks such as man‑in‑the‑middle by ensuring that only certificates issued by trusted authorities are accepted.