# Stupid SSL/Truststore question

**URL:** <https://forum.search-guard.com/t/stupid-ssl-truststore-question/439>\
**Category:** Search Guard\
**Created:** [April 19, 2017, 6:07pm UTC](https://forum.search-guard.com/t/stupid-ssl-truststore-question/439 "2017-04-19T18:07:58Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![pixelrebel](https://avatars.discourse-cdn.com/v4/letter/p/45deac/32.png) [@pixelrebel](https://forum.search-guard.com/u/pixelrebel)\
**Post date:** [April 19, 2017, 6:07pm UTC](https://forum.search-guard.com/t/stupid-ssl-truststore-question/439/1 "2017-04-19T18:07:58Z")

</div>

In the following script:  
[https://github.com/floragunncom/search-guard-ssl/blob/master/example-pki-scripts/gen\_root\_ca.sh#L77-L82](https://github.com/floragunncom/search-guard-ssl/blob/master/example-pki-scripts/gen_root_ca.sh#L77-L82)

The final dump to the trust store only dumps the root, shouldn’t it be including the whole chain (i.e. root+signing)?

Which leads to another dumb question: In order for self-signed certs to be accepted in general, do you have to include only the root or the whole chain in your circle of trust?

Thanks!

---

<div class="post-metadata">

**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\
**Post date:** [May 12, 2017, 8:11am UTC](https://forum.search-guard.com/t/stupid-ssl-truststore-question/439/2 "2017-05-12T08:11:50Z")

</div>

It’s kind of the other way round. The intermediate certificate is included in the keystore, alongside with the node’s own certificate.

[https://github.com/floragunncom/search-guard-ssl/blob/master/example-pki-scripts/gen\_node\_cert.sh#L72-L79](https://github.com/floragunncom/search-guard-ssl/blob/master/example-pki-scripts/gen_node_cert.sh#L72-L79)

When the node needs to identify itself, it sends its own cert + all intermediate certs. The other party then validates against the (trusted) root cert. Think of it as the first node being a webserver, the second node being a browser. The webserver needs to have its own cert + key plus all intermediate certs configured, the browser only has a list of trusted root CAs.

In order for a TLS connection to be established, you always need the full chain, end-to-end, with all intermediate certs. This has nothing to do with the cert being self-signed. You also need intermediate certs when you buy a cert from Thawte or the like.

By the way: The only difference between a certificate signed by your own Root CA and a certificate from, say, Thawte ist that browsers and OS ship with a list of trusted Root CAs. Which includes Thawte, but not your own. There’s no technical difference regarding content and structure of the certificates.

> **···**
>
> On Wednesday, April 19, 2017 at 8:07:58 PM UTC+2, pixelrebel wrote:
> 
> > In the following script:  
> > [https://github.com/floragunncom/search-guard-ssl/blob/master/example-pki-scripts/gen\_root\_ca.sh#L77-L82](https://github.com/floragunncom/search-guard-ssl/blob/master/example-pki-scripts/gen_root_ca.sh#L77-L82)
> > 
> > The final dump to the trust store only dumps the root, shouldn’t it be including the whole chain (i.e. root+signing)?
> 
> > Which leads to another dumb question: In order for self-signed certs to be accepted in general, do you have to include only the root or the whole chain in your circle of trust?
> 
> > 
> 
> > Thanks!