An intermediate certificate is issued by a root certificate authority (CA), or another trusted intermediate, and can sign additional certificates. It links those certificates to a trusted root, forming a chain that browsers and other clients can validate. This structure lets a root CA delegate certificate issuance without using its root key for every signing operation.
If an intermediate CA’s private key is compromised or poorly generated, an attacker may be able to issue certificates that appear valid along trusted paths. Defenders respond by revoking affected certificates and distributing distrust updates through browsers and platform trust stores. Cross-signing can create alternate paths, so responders must consider each route through the chain. A compromised intermediate creates broad potential risk, but does not by itself prove that forged certificates were issued or used.