Viewing Server Certificate Chain in Mozilla Firefox

PKI Tutorials - Herong's Tutorial Examples

∟Viewing Server Certificate Chain in Mozilla Firefox

This section provides a tutorial example on how to view certificate chain when visiting a 'https' Website in Mozilla Firefox. The top certificate in a certificate chain is the root CA certificate, which is trusted automatically.

When a browser validates a server certificate, it will try to build a certificate chain, also called certificate path, which is an ordered list of certificates that satisfy these conditions:

The first certificate must a CA (Certificate Authority) certificate that is trusted by the browser.
The subject of each certificate, except for the last, must be the issuer of the next certificate.
The last certificate is the server certificate to be validated.

Here is what I did to see the certificate chain for https://yahoo.com Website on Mozilla Firefox.

Visit https://login.yahoo.com with Firefox, and open the server certificate again as shown in the previous tutorial. The server certificate chain is displayed as tabs on the certificate viewer. Since root CA certificate is displayed as the last tab, you can read the certificate chain from right to left:

DigiCert High Assurance EV Root CA         - Root CA certificate
 |- DigiCert SHA2 High Assurance Server CA - Intermediate CA certificate
     |- *.fantasysports.yahoo.com          - Web server certificate

Server Certificate Chain in Mozilla Firefox 116

What do you think about this certificate chain? Should we trust login.yahoo.com now? I think this is a valid certificate chain and we should trust login.yahoo.com, because:

The root CA certificate "DigiCert High Assurance EV Root CA" is trusted because it was pre-installed in Firefox.
The intermediate CA certificate "DigiCert SHA2 High Assurance Server CA" is trusted because it was issued by a trusted root CA.
The login.yahoo.com certificate "*.login.yahoo.com" is trusted because it was issued by a trusted intermediate CA.

If you are using an older version, Firefox uses a dialog box to display the HTTPS server certificate with two tabs: "General" and "Details". The server certificate chain is displayed in the "Details" tab as shown below: