Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been trying to purchase SSL certificates for two new sites this month, and my usual provider (RapidSSL/GeoTrust) which used to be single root now has intermediate CA certificates. Customer service at several resellers have told me Geotrust doesn't do single root anymore on any of its certificates, and most cert vendor's websites don't have any definitive info about which are and aren't single root.

Does anyone know if you can still get single root certificates? Chained certs are a major pain to deal with.


locked by HopelessN00b Jan 25 '15 at 0:58

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

I don't know of any that do root issued certs anymore. The problem is they are afraid if the root issues a ton of publicly known certs a flaw might be found which allows an attacker to figure out the root certs.

This is highly unlikely, but by using an intermediate, and rotating that every year or so, they basically eliminate the possibility.

Using an chained cert is usually not that bad, except for very poorly written software.

+1 - I only had a problem with a chained cert once, with some rubbish VB software – Mark Henderson Jan 28 '11 at 20:27

Not the answer you're looking for? Browse other questions tagged or ask your own question.