title: How does it work: Found one SSL certificate two different chains and two different root CAs
body: <p>I bought an SSL Certificate from GeoTrust. </p>
  
  <p>On checking the certificate chain on different Devices I found <strong>two different chains</strong>. Both chain are <strong>valid!</strong></p>
  
  <p>On chain ends in Root-CA  <strong>C=US, O=Equifax, OU=Equifax Secure Certificate Authority</strong> and the other one in Root-CA <strong>C=US, O=GeoTrust Inc., CN=GeoTrust Global CA</strong>. </p>
  
  <p>The different between this chains are in the first chain "GeoTrust Global CA" is signed by "Equifax Secure Certificate Authority" and in at the second "GeoTrust Global CA" is self-signed. But in both chain the Fingerprint of "GeoTrust Global CA" is "C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E", only the Serial Number is different.</p>
  
  <p>How is this possible? I thought ssl certificates, the fingerprints of them and the cahins are unique!</p>
  
  <hr>
  
  <p>Chain 1)</p>
  
  <p>1a) <strong>C=US, O=GeoTrust Inc., OU=Domain Validated SSL, CN=GeoTrust DV SSL CA</strong> sign by <strong>C=US, O=GeoTrust Inc., CN=GeoTrust Global CA</strong></p>
  
  <pre><code>Data:
      Version: 3 (0x2)
      Serial Number: 145106 (0x236d2)
      Signature Algorithm: sha1WithRSAEncryption
      Issuer: C=US, O=GeoTrust Inc., CN=GeoTrust Global CA
      Validity
          Not Before: Feb 26 21:32:31 2010 GMT
          Not After : Feb 25 21:32:31 2020 GMT
      Subject: C=US, O=GeoTrust Inc., OU=Domain Validated SSL, CN=GeoTrust DV SSL CA
      X509v3 extensions:
          X509v3 Key Usage: critical
              Certificate Sign, CRL Sign
          X509v3 Subject Key Identifier:
              8C:F4:D9:93:0A:47:BC:00:A0:4A:CE:4B:75:6E:A0:B6:B0:B2:7E:FC
          X509v3 Authority Key Identifier:
              keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E
  </code></pre>
  
  <p>1b) <strong>C=US, O=GeoTrust Inc., CN=GeoTrust Global CA</strong> sign by <strong>C=US, O=Equifax, OU=Equifax Secure Certificate Authority</strong></p>
  
  <pre><code>Data:
      Version: 3 (0x2)
      Serial Number: 1227750 (0x12bbe6)
      Signature Algorithm: sha1WithRSAEncryption
      Issuer: C=US, O=Equifax, OU=Equifax Secure Certificate Authority
      Validity
          Not Before: May 21 04:00:00 2002 GMT
          Not After : Aug 21 04:00:00 2018 GMT
      Subject: C=US, O=GeoTrust Inc., CN=GeoTrust Global CA
      X509v3 extensions:
          X509v3 Authority Key Identifier:
              keyid:48:E6:68:F9:2B:D2:B2:95:D7:47:D8:23:20:10:4F:33:98:90:9F:D4
  
          X509v3 Subject Key Identifier:
              C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E
          X509v3 Basic Constraints: critical
              CA:TRUE
  </code></pre>
  
  <p>1c) Root-CA  <strong>C=US, O=Equifax, OU=Equifax Secure Certificate Authority</strong></p>
  
  <pre><code>Data:
      Version: 3 (0x2)
      Serial Number: 903804111 (0x35def4cf)
      Signature Algorithm: sha1WithRSAEncryption
      Issuer: C=US, O=Equifax, OU=Equifax Secure Certificate Authority
      Validity
          Not Before: Aug 22 16:41:51 1998 GMT
          Not After : Aug 22 16:41:51 2018 GMT
      Subject: C=US, O=Equifax, OU=Equifax Secure Certificate Authority
      X509v3 extensions:
          X509v3 Private Key Usage Period:
              Not After: Aug 22 16:41:51 2018 GMT
          X509v3 Key Usage:
              Certificate Sign, CRL Sign
          X509v3 Authority Key Identifier:
              keyid:48:E6:68:F9:2B:D2:B2:95:D7:47:D8:23:20:10:4F:33:98:90:9F:D4
  
          X509v3 Subject Key Identifier:
              48:E6:68:F9:2B:D2:B2:95:D7:47:D8:23:20:10:4F:33:98:90:9F:D4
  </code></pre>
  
  <hr>
  
  <p>Chain 2)</p>
  
  <p>2a) <strong>C=US, O=GeoTrust Inc., OU=Domain Validated SSL, CN=GeoTrust DV SSL CA</strong> sign by <strong>C=US, O=GeoTrust Inc., CN=GeoTrust Global CA</strong></p>
  
  <pre><code>Data:
      Version: 3 (0x2)
      Serial Number: 145106 (0x236d2)
      Signature Algorithm: sha1WithRSAEncryption
      Issuer: C=US, O=GeoTrust Inc., CN=GeoTrust Global CA
      Validity
          Not Before: Feb 26 21:32:31 2010 GMT
          Not After : Feb 25 21:32:31 2020 GMT
      Subject: C=US, O=GeoTrust Inc., OU=Domain Validated SSL, CN=GeoTrust DV SSL CA
      X509v3 extensions:
          X509v3 Key Usage: critical
              Certificate Sign, CRL Sign
          X509v3 Subject Key Identifier:
              8C:F4:D9:93:0A:47:BC:00:A0:4A:CE:4B:75:6E:A0:B6:B0:B2:7E:FC
          X509v3 Authority Key Identifier:
              keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E
  </code></pre>
  
  <p>2b)  Root-CA  <strong>C=US, O=GeoTrust Inc., CN=GeoTrust Global CA</strong></p>
  
  <pre><code>Data:
      Version: 3 (0x2)
      Serial Number: 144470 (0x23456)
      Signature Algorithm: sha1WithRSAEncryption
      Issuer: C=US, O=GeoTrust Inc., CN=GeoTrust Global CA
      Validity
          Not Before: May 21 04:00:00 2002 GMT
          Not After : May 21 04:00:00 2022 GMT
      Subject: C=US, O=GeoTrust Inc., CN=GeoTrust Global CA
      X509v3 extensions:
          X509v3 Basic Constraints: critical
              CA:TRUE
          X509v3 Subject Key Identifier:
              C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E
          X509v3 Authority Key Identifier:
              keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E
  </code></pre>