Are single root SSL certificates available anymore?

Question

I've been trying to purchase SSL certificates for two new sites this month, and my usual provider (RapidSSL/GeoTrust) which used to be single root now has intermediate CA certificates. Customer service at several resellers have told me Geotrust doesn't do single root anymore on any of its certificates, and most cert vendor's websites don't have any definitive info about which are and aren't single root.

Does anyone know if you can still get single root certificates? Chained certs are a major pain to deal with.

Answer 1

I don't know of any that do root issued certs anymore. The problem is they are afraid if the root issues a ton of publicly known certs a flaw might be found which allows an attacker to figure out the root certs.

This is highly unlikely, but by using an intermediate, and rotating that every year or so, they basically eliminate the possibility.

Using an chained cert is usually not that bad, except for very poorly written software.