Root Certificate vs Intermediate Certificate

Reading Time: 5–6 min

Root Certificate vs Intermediate Certificate

Root Certificates and Intermediate Certificates are both essential components of the SSL certificate chain, but they serve different purposes.

The Root Certificate establishes the highest level of trust, while the Intermediate Certificate acts as the secure bridge between the Root Certificate and your website's SSL certificate.

Understanding the difference helps explain how browsers securely verify HTTPS websites.

What is a Root Certificate?

A Root Certificate is the trust anchor of the Public Key Infrastructure (PKI).

It belongs to a trusted Certificate Authority (CA) and is pre-installed in browsers, operating systems, and devices.

Because Root Certificates are extremely valuable, they are heavily protected and usually kept offline.

Their primary role is to issue Intermediate Certificates not website certificates directly.

What is an Intermediate Certificate?

An Intermediate Certificate is issued by a Root Certificate.

Its job is to sign SSL certificates that are installed on websites.

Using Intermediate Certificates protects the Root Certificate from unnecessary exposure while maintaining the same chain of trust.

The SSL Trust Chain

Every secure HTTPS website follows this hierarchy:

Root Certificate

        ↓

Intermediate Certificate

        ↓

Website SSL Certificate

When a visitor opens your website, the browser verifies each certificate in this chain before establishing an encrypted connection.

Why Not Use the Root Certificate Directly?

If Root Certificates were used to sign every website certificate directly, they would be exposed to unnecessary security risks.

Instead:

• The Root Certificate signs one or more Intermediate Certificates.

• Intermediate Certificates issue website SSL certificates.

• If an Intermediate Certificate is compromised, it can be revoked without replacing the trusted Root Certificate.

This layered design improves the security and scalability of the global SSL ecosystem.

Who Owns Root Certificates?

Trusted Root Certificates are issued and managed by recognised Certificate Authorities such as:

• DigiCert

• Sectigo

• GlobalSign

• Let's Encrypt

• Entrust

Browsers and operating systems include lists of trusted Root Certificates, known as Root Stores.

Only Certificate Authorities that meet strict security and auditing requirements are included.

Which Certificate Does My Website Use?

Your website installs:

• Your SSL certificate (Leaf Certificate)

• One or more Intermediate Certificates

Visitors' browsers already contain the trusted Root Certificates needed to complete the chain.

This is why website administrators do not install Root Certificates on their servers.

What Happens if a Root Certificate Is Not Trusted?

If a browser cannot verify a trusted Root Certificate, it cannot establish the chain of trust.

This may result in:

• Browser security warnings

• HTTPS errors

• Certificate trust failures

• Blocked secure connections

Even if the website certificate itself is valid, the connection will not be trusted unless the Root Certificate is recognised.

Frequently Asked Questions

Which certificate is more important?

Both are essential.

The Root Certificate establishes trust, while the Intermediate Certificate safely distributes that trust to websites.

Can a website work without an Intermediate Certificate?

Usually not.

Most public SSL certificates require the correct Intermediate Certificate to complete the certificate chain.

Does every browser contain Root Certificates?

Yes.

Modern browsers and operating systems maintain trusted Root Certificate stores that are regularly updated.

Related Articles

• Certificate Chain Explained

• What is an Intermediate Certificate?

• Root vs Intermediate Certificate

• What is a Leaf Certificate?

Certificate Authority Explained