I've been trying to purchase SSL certificates for two new sites this month, and my usual provider (RapidSSL/GeoTrust) which used to be single root now has intermediate CA certificates. Customer service at several resellers have told me Geotrust doesn't do single root anymore on any of its certificates, and most cert vendor's websites don't have any definitive info about which are and aren't single root.

Does anyone know if you can still get single root certificates? Chained certs are a major pain to deal with.

locked by HopelessN00b Jan 25 '15 at 0:58

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. See the help center for guidance on writing a good question.

Read more about locked posts here.


I don't know of any that do root issued certs anymore. The problem is they are afraid if the root issues a ton of publicly known certs a flaw might be found which allows an attacker to figure out the root certs.

This is highly unlikely, but by using an intermediate, and rotating that every year or so, they basically eliminate the possibility.

Using an chained cert is usually not that bad, except for very poorly written software.

  • +1 - I only had a problem with a chained cert once, with some rubbish VB software – Mark Henderson Jan 28 '11 at 20:27

Not the answer you're looking for? Browse other questions tagged or ask your own question.