Unverified50% confidenceFactExact time
Browsers and operating systems have built-in trusted root certificate lists, and only certificates issued by these root certificates or their subordinate intermediate CAs are considered valid.
1
Sources
50%
Confidence
Long-term
Relevance
10/23/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedOnce attackers obtain the intermediate CA's private key, they can issue TLS certificates for arbitrary domains in that CA's name, and end-user browsers and operating systems typically trust intermediate certificates derived from legitimate root CAs.75% similarUnverifiedIf a CA wants its certificates to be trusted by browsers, it must pass third-party audits such as WebTrust and continuously meet the CA/B Forum baseline requirements.75% similarUnverifiedSite operators should confirm whether their own certificate chain includes the affected intermediate CA, and monitor trust store update announcements from the CA/Browser Forum and mainstream browser vendors to replace affected certificates in a timely manner.73% similarUnverifiedIn the PKI system, root certificates are usually kept offline and rarely issue end-entity certificates directly, while intermediate CAs handle day-to-day issuance duties.73% similarUnverifiedApplications that ignore the system certificate store will throw errors such as UNABLE_TO_VERIFY_LEAF_SIGNATURE or self signed certificate in managed network environments.70% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1091494API
curl https://kongchang.com/api/v1/knowledge/claims/1091494MCP
get_claim(id=1091494)