IE Supporting Multiple Certificate Paths

PKI Tutorials - Herong's Tutorial Examples

∟IE Supporting Multiple Certificate Paths

This section provides a tutorial example showing IE supports multiple certificate paths for 'login.yahoo.com'.

After deleted the root certificate "VeriSign Class 3 Public Primary Certification Authority - G5", which issued "VeriSign Class 3 Secure Server CA - G3", which issued "*.login.yahoo.com", I want to visit https://login.yahoo.com again with IE to see what will happen.

1. Run IE and go to https://login.yahoo.com and wait for the log in page to be displayed.

2. Click the lock icon at the end of the Web address field. A small pop up windows shows up.

3. Click the "View certificates" link on the pop up window. The Certificate dialog box shows up.

4. Click the "Certificate Path" tab. I am surprised to see that IE validated "login.yahoo.com" certificate with a new certificate path:

VeriSign Class 3 Public Primary Certification Authority (PCA3 G1 SHA1)
                                      - Root CA certificate
 |- VeriSign Class 3 Public Primary Certification Authority - G5
                                      - Intermediate CA certificate
     |- VeriSign Class 3 Secure Server CA - G3
                                      - An intermediate CA certificate
         |- *.login.yahoo.com         - Web server certificate

5. Remember the certificate path used by IE before I deleted "VeriSign Class 3 Public Primary Certification Authority - G5" certificate with a display of "VeriSign" from the trust root CA certificate tab. It looked like this:

VeriSign                                   - Root CA certificate
 |- VeriSign Class 3 Secure Server CA - G3 - Intermediate CA certificate
     |- *.login.yahoo.com                  - Web server certificate

The explanation is that there are two certificates with the same identity name "VeriSign Class 3 Secure Server CA - G3":

One is issued by "VeriSign Class 3 Public Primary Certification Authority - G5" as a root CA certificate with a display name of "VeriSign".
Another is issued by VeriSign Class 3 Public Primary Certification Authority - G5" as an intermediate certificate, which is issued by a different root CA certificate, "Class 3 Public Primary Certification Authority", with a display name of "VeriSign Class 3 Public Primary Certification Authority (PCA3 G1 SHA1)".