1

I navigated to www.flipkart.com and viewed its certificate chain. There were two intermediate certificates namely Go Daddy Secure Certificate Authority - G2 and Go Daddy Root Certificate Authority - G2 and root certificate namely Go Daddy Class 2 Certification Authority.

I observed that Go Daddy Root Certificate Authority - G2 was signed by Go Daddy Class 2 Certification Authority. Now I went to my system certificate store and saw that Go Daddy Root Certificate Authority - G2 was self signed (meaning it was under root store).

How does this happen? Am I not updated? When I saw through the website it appeared like it was signed by another CA but when I viewed through store it's showing self signed?

Screenshot of certificate Go Daddy Root Certificate Authority - G2 taken from Flipkart: Flipkart certificate screenshot

Screenshot of certificate Go Daddy Root Certificate Authority - G2 taken from Windows store: Windows Store screenshot

Now if you notice, the serial number of same certificates are different in browser view and system view

  • Can you post images of the full certificate chain? I think that it is expected that a Root Certificate Authority would be self signed. They are a trusted third party that validates the existence of other individuals. But if they are compromised their self signed certificate can no longer be trusted. – Dion Pezzimenti Apr 1 at 13:46
3

The same Common Name and key can be used in different certificate files to offer multiple paths to certify:

Path 1 (your browser considered this path, because the server sent that intermediate)

Because this chain links the website certificate to a trusted CA in store, the website certificate can be trusted.

Path 2 (this is in your system certificate store, your browser can verify this one as well)

Because this chain links the website certificate to a trusted CA in store, the website certificate can be trusted.


In this case, both paths are accepted by all popular browsers.

The avaiability of two separate paths based on your certificate store (system and/or browser) is not a sign of malicious activity. Sometimes multiple, sometimes changing certification paths are used for a number of bureaucratic and technical reasons in the CA landscape. The people who work on browser or maintaining root certificate stores (Mozilla, Microsoft, ..) are taking much care to consider all implications of this.

Note: Your example website offers the self-signed "Class 2" certificate to the browser as well. It is not useful to typical browsers, because they have it already, but it also does not hurt (apart from causing unnecessary traffic).

  • Oh! So why chrome validates the chain is because it forms the chain during SSL handshake and so ignores the system store certificates right? @anx – Oxia Apr 1 at 14:22
  • Also if you notice in system store the serial numbers of Go Daddy Root Certificate Authority - G2 and Go Daddy Class 2 Certification Authority are 00. So its technically incorrect right? @anx – Oxia Apr 1 at 14:24
  • Chrome uses the certificate store to construct one trusted path and has not use for another one. The requirements introduced regarding serial number generation are only concerning newly issued certificates. – anx Apr 1 at 15:09
0

I think this expected behavior:

https://blogs.msdn.microsoft.com/kaushal/2013/01/09/self-signed-root-ca-and-intermediate-ca-certificates

The Root CA certificate would be self signed as they are a trusted third party to validate other entities. However if they are compromised their Root CA would no longer be valid. Look at the details of the cert it should tell you when it expires. That's the true sign your certs are up to date in your local CA store.

Append

Based on your comment I did a little digging:

https://certdb.com/domain/godaddy.com

Both certs are valid. You can tell by Valid From and Valid To dates. As for your inquiry about different issuers. I would imagine they have different classes and tiers of certificates. Depending on the certificate being issued to an Intermediary CA or entity would depend on the Go Daddy issuer.

One I think is higher in terms of the chain. The one from Flipkart I think is one that is lower on their cert chain.

  • I have added the screenshots, check them out and notice that same certificates have different serial numbers. You can check them out on your windows too – Oxia Apr 1 at 13:57
  • And also notice the issuer in both @Dion Pezzimenti – Oxia Apr 1 at 13:58
  • I couldn't say specifically why there are two. Without knowing GoDaddys CA Structure. They could have multiple Root CA servers due to the amount of certificates they issue. Both certs seem valid within the dates they were issued. Seems like they must issue different certs differently. Ultimately I think you are fine. No reason to worry. – Dion Pezzimenti Apr 1 at 14:04
  • I appended my answer to hopefully alleviate your additional inquiries. – Dion Pezzimenti Apr 1 at 14:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.