Chained Certificates? Insist On Single Root

When connecting to a web site over SSL, the visitor's web browser decides whether or not to trust the SSL Certificate based on which Certification Authority has issued the actual SSL Certificate. To determine this, the browser looks at its own internal list of trusted Certification Authorities. These are added into the browser by the browser vendor (such as Microsoft, Netscape and Mozilla).

Most SSL Certificates are issued by Certification Authorities who own and use their own Trusted Root CA Certificates. We only issue SSL Certificates that are Single Root, this means they have already been added into the browser by the browser vendor and are regarded as highly trusted. Some newer certificates (such as Extended Validation SSL Certificates) may contain a Chained Certificate, however we will only provide Chained Certificates when the Certification Authority owns the Root Certificate associated with it.

Some Certification Authorities do not have a Trusted Root CA Certificate present in browsers, or do not use a root that they own, and use a Chained Root in order for their SSL Certificates to be trusted. Essentially a Certification Authority with a Trusted Root CA Certificate issues a Chained Certificate which inherits the browser recognition of the Trusted Root CA. These SSL Certificates are known as Chained Root SSL Certificates.

For a Certification Authority to have and use its own Trusted Root CA Certificate already present in browsers is a clear sign that they are long time, stable and credible organizations who have long term relationships with the browser vendors (such as Microsoft, Mozilla and Netscape) for the inclusion of their Trusted Root CA Certificates. For this reason, such Certification Authorities are seen as being considerably more credible and stable than chained root certificate providers who do not have a direct relationship with the browser vendors, or do not use their own root certificates to issue SSL Certificates.

You can view the Certification Authorities who have and use their own root certificates by viewing the list in your browser.

Chained Root certificates require additional effort to install as the web server must also have the Chained Root installed. This is not necessary for our Single Root Certificates.