# OpenSSL Certification Authority (CA) on Ubuntu Server **URL:** https://forum.networklessons.com/t/openssl-certification-authority-ca-on-ubuntu-server/1338 **Category:** Lessons Discussion **Created:** [December 29, 2016, 9:15pm UTC](https://forum.networklessons.com/t/openssl-certification-authority-ca-on-ubuntu-server/1338 "2016-12-29T21:15:10Z") **Posts on this page:** 1 **Showing post:** 5
### Author: ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis) #### Post date: [July 2, 2022, 6:53am UTC](https://forum.networklessons.com/t/openssl-certification-authority-ca-on-ubuntu-server/1338/5 "2022-07-02T06:53:51Z")
Hello Mohammad > [@Hamoud.mh85](#): > > when wee use intermediate CA and the root CA is offline how will Intermediate CA access Private Key of Root CA for signing a new generated Certificat ? in this Case the Intermediate will use its own root Certificate that has been signed by root CA Certificate ? but how this will occur ? In the lesson here, the root CA is used to sign certificates. However, in a production network this is not best practice. In order to maintain a hierarchy, and more easily manage certificates, intermediate CAs are used. How do they work? Well, the root CAs issue intermediate CAs, which can be used to sign certificates. This adds layers of security and helps to minimize problems in the event of an incorrect issuing of a certificate. In such a case, rather than revoking the root certificate, and every certificate issued, you only need to revoke the certificates issued by the intermediate CA. The root CA signs the intermediate root with its private key, which makes it trusted. Then the CA uses the **intermediate certificate’s private key** to sign and issue certificates. That’s OK because the root CA has trusted the intermediate CA to do this. You may have several intermediate root CAs that create a certificate change that leads back to the root CA. It may look like this: Root CA → Intermediate CA 1 → Intermediate CA 2 → Intermediate CA 3 → Certificate Since trust is established at each step, the certificate is considered valid and can be traced back to the root. > [@Hamoud.mh85](#): > > second Question : should client has both CA Root Certificate and Server Certificate locally installed to trust the presented Certificate from Web server for example ? or It should only has the Server Certificate installed and when this Server Certificate is presented then It can ask the CA Server if this Certificate is trusted or not ? Both scenarios would work, however the second may be somewhat more secure. If it contacts the CA server if this certificate is trusted, it will ensure that it is still currently valid. I hope this has been helpful! Laz --- _[View the full topic](https://forum.networklessons.com/t/openssl-certification-authority-ca-on-ubuntu-server/1338)._