Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've been trying to purchase SSL certificates for two new sites this month, and my usual provider (RapidSSL/GeoTrust) which used to be single root now has intermediate CA certificates. Customer service at several resellers have told me Geotrust doesn't do single root anymore on any of its certificates, and most cert vendor's websites don't have any definitive info about which are and aren't single root.

Does anyone know if you can still get single root certificates? Chained certs are a major pain to deal with.

share|improve this question

1 Answer 1

I don't know of any that do root issued certs anymore. The problem is they are afraid if the root issues a ton of publicly known certs a flaw might be found which allows an attacker to figure out the root certs.

This is highly unlikely, but by using an intermediate, and rotating that every year or so, they basically eliminate the possibility.

Using an chained cert is usually not that bad, except for very poorly written software.

share|improve this answer
    
+1 - I only had a problem with a chained cert once, with some rubbish VB software –  Mark Henderson Jan 28 '11 at 20:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.