Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is the difference between a root CA and an intermediate CA?
Short answer
A root CA is the CA at the top of the certificate chain: it signs its own certificate itself and is in the clients' trust store. An intermediate (issuing) CA is signed by the root CA or by another intermediate CA and signs the server and client certificates in everyday use. This separation protects the root key: the root is used only to sign intermediate CAs, and if the key of an intermediate CA is compromised, only that CA is replaced. TR7's internal PKI also has two tiers: the root is set up with Create Root CA, and the issuing CA that issues certificates under this root with Create Issuing CA; only the issuing CA signs certificates.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| Certificates & PKI → Certificate Authorities (CA) → Add → Operation | Create Root CA, Create Issuing CA (Parent CA = an internal root CA), Enroll under an external CA | Setting up a two-tier internal CA; having the issuing CA signed by the organization's existing root CA |
| Certificate Authorities (CA) list | Kind: Internal Root CA, Internal Issuing CA; CA Role: Root, Intermediate | The place of the CA in the hierarchy |
| Create Issuing CA, Enroll under an external CA | Usage: Server certificates, Client certificates | Whether the issuing CA will issue server or client certificates |
| SSL/TLS Certificates → Internal CA | Issuing CA | Only the issuing CAs that issue server certificates are in the list |
| SSL/TLS Certificates → preview → Chain | Link roles: Root CA, Intermediate CA, Certificate | Seeing the CAs in the chain of the certificate |
Comparison
| Root CA | Intermediate (issuing) CA | |
|---|---|---|
| Who signs its certificate | Itself (self-signed) | The CA above it |
| Where it is found | In the clients' trust store | In the chain the server sends |
| What it signs | Intermediate CAs | Server and client certificates |
| Use of the key | Rare; kept offline in most organizations | Continuous |
| In TR7 | Create Root CA (default key RSA 4096, Lifetime (days) 3650) | Create Issuing CA or Enroll under an external CA |
Common Misconceptions
- "Server certificates must be signed directly by the root CA." Frequent use of the root key increases the risk; certificates are signed by the intermediate CA. In TR7, certificates of the Internal CA type are issued only by an issuing CA.
- "The intermediate CA must be distributed to clients." The root is distributed to clients; the server sends the intermediate certificate as part of the chain.
- "If the organization has its own root CA, a separate root must be set up in TR7." With Enroll under an external CA, the CSR of the issuing CA generated in TR7 is signed by the organization's root CA; in this case, the root that the clients already trust continues to be used.
How it is done in the documentation
