What is Intermediate Certificate?

An intermediate certificate is a digital certificate issued by a root certificate authority (CA) and used to sign end-entity (leaf) certificates, such as TLS server certificates. It sits between the root CA and the leaf certificates in a certificate chain. The root CA signs the intermediate certificate, binding the intermediate's public key to its identity and granting it authority to issue certificates. This delegation allows the root CA to remain offline and secure, while the intermediate CA performs day-to-day operations.

In practice, a root CA key is kept in a highly secure, physically isolated environment and is only used infrequently to sign intermediate certificates. The intermediate CA, whose key is online but still protected, then issues end-entity certificates. When a client validates a server certificate, it receives the server's leaf certificate plus one or more intermediate certificates. The client's trust store contains only the root CA certificate. The client builds a chain from the leaf up to the trusted root, verifying each signature. The intermediate certificate provides the cryptographic link: its issuer is the root, and its subject is the CA that signed the leaf.

Intermediate certificates are essential for operational security and key management. They limit exposure of the root key, allow revocation of a compromised intermediate without reissuing all leaf certificates, and enable organizational separation of duties. Standards such as the CA/Browser Forum Baseline Requirements mandate that publicly trusted CAs use at least one intermediate. The chain depth can include multiple intermediates, but each must be signed by its parent. Without proper intermediate certificates in the server's TLS handshake, clients cannot build a complete chain and will reject the connection.