Intermediate CA

An intermediate CA, also called an intermediate certificate authority, holds signing authority that another certificate authority delegates through a certificate chain. A chain normally connects a website certificate to a trusted root, sometimes through several intermediate certificates. Certificate constraints limit the delegated authority. Compromise of an intermediate CA's private key can permit fraudulent certificate signatures within that authority. Clients must apply relevant distrust or revocation updates. Replacing one website certificate does not remove a compromised intermediate key from other clients' trust decisions.