r/cryptography•
0x4ddd

How does X509 certificate chain building works

I mean, I know there are trust stores, there is AIA extension to download issuer certificate etc.

But assume I have X509 client cert and a set of issuer certs which are trusted by me. This is completely offline building scenario.

As far as I know, X509 certificate does not include issuer's serial number or thumbprint or any other data beyond issuer's name in X500 format.

So in order to check whether leaf comes from any cert trusted by me, should I extract leaf issuer name and try to find trust anchor where it's subjectName equals to leaf's issuer name?

Assuming for some reason (valid or not, these are theoretical considerations) I have multiple trust anchors with the same subjectName, I guess all of them could be candidates and I need to verify which one public key correctly validates leaf signature?

Posted Apr 8, 2025, 9:16 PM UTC

46
Loading comments…