An intermediate certificate authority (CA) is a certificate issuer positioned between a root CA and the certificates it signs. The root CA delegates signing authority to the intermediate by issuing it a certificate, creating a chain of trust that browsers and other software can validate. Intermediate CAs let organizations issue certificates without using the root key for routine operations.
Because an intermediate’s private key can authorize many certificates, its compromise or weak generation can allow unauthorized certificates to be created. Attackers could use those certificates to impersonate websites or services while relying software still trusts the chain. Defenders protect intermediate keys, monitor issued certificates, and apply distrust or revocation updates when necessary. They should also check that operating systems, applications, and custom trust stores receive those updates, since they may not follow browser trust decisions automatically.