{"id":4794,"date":"2026-09-10T11:17:06","date_gmt":"2026-09-10T11:17:06","guid":{"rendered":"https:\/\/certera.com\/blog\/?p=4794"},"modified":"2026-09-10T11:17:07","modified_gmt":"2026-09-10T11:17:07","slug":"what-is-a-cross-certificate-in-pki-how-does-it-maintain-continuous-trust-chains","status":"publish","type":"post","link":"https:\/\/certera.com\/blog\/what-is-a-cross-certificate-in-pki-how-does-it-maintain-continuous-trust-chains\/","title":{"rendered":"What is a Cross Certificate in PKI? How it Helps Maintain Continuous PKI Trust?"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Key Takeaways<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cross certificates provide continuous trust between autonomous PKI domains.<\/li>\n\n\n\n<li>They offer one-way or two-way trust without the consolidation of root CAs.<\/li>\n\n\n\n<li>Well-designed architecture \u2013 either bilateral, bridge, or mesh \u2013 and strict constraints help make the cross-certificate solution both safe and scalable.<\/li>\n\n\n\n<li>Analysis of cross and intermediate certificates helps determine which type is best for each particular purpose.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Introduction<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Different entities use separate PKIs, and each has a different root of trust. This makes it impossible for users to validate certificates and their identities between trust domains. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To solve this problem, cross-certificates come into play, as they make connections between separate trust domains while maintaining certification paths without requiring organisations to unify their root.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><a><\/a>What Is a Cross Certificate in PKI?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A cross certificate is a CA certificate issued by a CA to another CA from outside of the <a href=\"https:\/\/certera.com\/blog\/what-is-a-ca-certificate-authority-role-pki-trust-hierarchies\/\">CA\u2019s hierarchy<\/a>. It is like a trust bridge that tells relying parties that certificates issued by CA B are to be trusted within the limits set out in the cross-certificate by CA A signing the public key of CA B.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Unlike end-entity certificates, cross certificates do not authenticate a user, device, or server; instead, they authenticate another CA. It should also be noted that a cross certificate is different from a subordinate CA certificate because a subordinate CA is always inferior to the issuing entity and is part of the same hierarchy and usually does not have any independent self-signed root for certificate path building.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Organisations employ cross certificates to achieve one-way or mutual trust relationships within two separate PKI domains. This leads to the establishment of trust chains that extend through corporations, government organisations, or industries as a whole, while preserving full authority over the root certificate on the part of each of the PKI domains involved.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Also Read:<\/strong> <a href=\"https:\/\/certera.com\/kb\/how-to-add-a-cross-sign-certificate-to-the-chain-on-windows-platform-iis\/\">How to Add a Cross-Sign Certificate to the Chain on Windows Platform IIS?<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why Do We Need Cross Certificates?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Independent root CAs create trust silos. Certificates signed by one <a href=\"https:\/\/certera.com\/blog\/root-certificate-vs-intermediate-certificate-the-real-difference\/\">root CA<\/a> would not be verified by another CA, resulting in failed secure communication as soon as two organisations start working together.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Almost any government organisation, corporation, or industry consortium will operate on a separate PKI. They need to exchange sensitive information. They have to sign agreements with each other. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Participants in supply chains need <a href=\"https:\/\/certera.com\/blog\/what-is-mtls-authentication-mutual-tls\/\">mutual device authentication<\/a>. None of them is able, and not willing, to abandon their roots and join a single PKI hierarchy.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Cross certificates become vital in many practical situations involving continuous trust:<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Federated identity systems, which allow the use of common credentials to access partner portals<\/li>\n\n\n\n<li>Secure communication via <a href=\"https:\/\/certera.com\/smime-certificates\">e-mail and document signing<\/a> across organisations<\/li>\n\n\n\n<li>IoT platforms that involve devices from different vendors<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">These elements will be missing, causing the breakage of the trust chain. Authentication errors will ensue for users, who may have to depend on insecure solutions or manual issuance of certificates by administrators. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Development will be delayed, risks of noncompliance will grow, and the cost of collaboration will increase. Cross certificates address all these difficulties while maintaining the total autonomy of each domain.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Also Read:<\/strong> <a href=\"https:\/\/certera.com\/blog\/public-key-infrastructure-pki-use-cases-for-modern-enterprise-security\/\">Public Key Infrastructure (PKI)\u00a0Use Cases for Modern Enterprise Security<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How Cross Certificates Work?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><a><\/a>Basic Steps in Creating a Trust Chain<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">CA A makes a cross certificate by issuing a certificate signed with the public key of CA B. The certificate created by CA A uses CA B as the subject name.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The relying party initiates with a leaf certificate from CA B and climbs up: leaf certificate \u2192 certificate of CA B itself \u2192 cross certificate from CA A \u2192 trusted root of CA A.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><a><\/a>One-Way vs Mutual Cross-Certification<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In one way cross certification, CA A certifies CA B, allowing users who trust A to validate certificates issued by B. The reverse does not work, so trust flows from A to B.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Mutual cross-certification is when CA A certifies CA B and vice versa. Now each of them can use certificates for creating paths to the other\u2019s realm. For path validation, all that is needed is to follow the certificates in the necessary direction according to the trust anchor of the relying entity.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><a><\/a>Path Building and Path Validation<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Traditional path validation algorithms treat the cross-certificates as if they were regular CA certificates. They validate the certificate chains, check validity intervals, and implement critical extensions. The parameter <strong>pathLenConstraint<\/strong> defines the maximum number of CA certificates following the cross-certificate. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The extension <strong>nameConstraints<\/strong> limits the names that B can certify. The extension <strong>policyMappings<\/strong> converts policies from one realm to another, allowing relying parties to accept the chain.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">PKI Cross Certification Architecture Explained<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><a><\/a>Simple Bilateral Cross-Certification<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Independent CAs sign cross-certificates for each other. CA A signs the public key of CA B and vice versa. Each CA keeps its own root certificate, while end-users from both domains are able to build valid paths across the boundary. Such an approach is perfect for direct partnership.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><a><\/a>Hierarchical Bridge CA Approach<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">There is a central Bridge CA that connects multiple member CAs through cross-certificates to each of them. A member CA has just one connection with the bridge rather than a separate certificate for each participating CA. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Federal Bridge CA, used in U.S. government agencies, operates based on this approach. Path validation is performed via the bridge, and the number of certificates is reduced from dozens to a few.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><a><\/a>Mesh Configuration<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Mesh is the case when each CA cross-certifies each other&#8217;s CAs. The outcome is the highest flexibility since any path can be formed without any intermediate CA. However, the number of certificates increases quadratically. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Administrators have a large operational burden starting from a few participants in the system. The mesh approach is viable for a small number of CAs only.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><a><\/a>Anchor of Trust and Policy Considerations<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The relying party remains confident in its local root as the only trust anchor. Cross certificates are used to create more pathways out of this trust anchor. <strong>Certificate policies and policyMappings<\/strong> become extremely important. They interpret the requirements of one domain in the language of another domain.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Cross Certificate vs Intermediate Certificate<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td><strong>Aspect<\/strong><\/td><td><strong>Cross Certificate<\/strong><\/td><td><strong>Intermediate Certificate<\/strong><\/td><\/tr><tr><td>Purpose<\/td><td>Bridge two independent PKI domains<\/td><td>Extend trust within a single hierarchy<\/td><\/tr><tr><td>Issuer\u2013Subject Relationship<\/td><td>Different root CAs<\/td><td>Same root CA hierarchy<\/td><\/tr><tr><td>Trust Direction<\/td><td>Can be one-way or mutual<\/td><td>Always downward from the root<\/td><\/tr><tr><td>Path Validation Impact<\/td><td>Adds a horizontal link<\/td><td>Adds a vertical link<\/td><\/tr><tr><td>Typical Use Case<\/td><td>Inter-organizational trust<\/td><td>Organizational internal hierarchy<\/td><\/tr><tr><td>Revocation &amp; Lifecycle<\/td><td>Managed by both participating CAs<\/td><td>Managed solely by the issuing hierarchy<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Select the cross certificate where two different organisations need to communicate with each other, but the roots should not merge. Select the intermediate certificate where an organisation needs to build or divide its trust internally. This depends on whether the relationship between these entities is peer-to-peer or hierarchical.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Real World Instances of Cross Certificates<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><a><\/a>Governments and Defence Alliances<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The U.S. Federal Bridge CA connects multiple federal government PKIs and approved third parties. Agencies like the Department of Defence and the Department of State use cross-certification via the bridge so that their employees can authenticate across different departments. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Military defence alliances, including the CCEB nations, cross-certify between military PKIs of different countries so that they can operate in coalition effectively.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><a><\/a>Commercial Bridge Systems<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Commercial industry-based bridge models also exist. CertiPath runs a commercial bridge CA for defence and aerospace industry suppliers. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The organisation allows its members, which include companies like <strong>Boeing and Lockheed Martin<\/strong>, to cross-certify with the bridge once so that they can establish trust with all other members as well as the Federal Bridge. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>SAFE-BioPharma<\/strong> is another example of a bridge organization that runs a bridge for healthcare and pharmaceuticals that have to exchange signed regulatory documents digitally.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><a><\/a>Enterprise Merger and Acquisition<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In mergers, the acquiring firm usually issues temporary cross certificates to the <a href=\"https:\/\/certera.com\/blog\/root-certificate-vs-intermediate-certificate-the-real-difference\/\">root or intermediate CA<\/a> of the target company. This helps to maintain communication via email, VPN, and digital signature during integration.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><a><\/a>Ecosystems of Public Trust Certificates<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Some Commercial CAs sometimes cross-certify private enterprise roots as Non-Federal Issuers across the Federal Bridge. Such arrangements enable contractors to have their credentials used for government systems without putting all private roots in public trust stores. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Pure public-root cross-certifications happen rarely and only for the sake of compatibility and not for true inter-domain federation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Also Read:<\/strong> <a href=\"https:\/\/certera.com\/blog\/what-is-a-merkle-tree-certificate-mtc-detailed-guide\/\">What Is a Merkle Tree Certificate (MTC)? [Detailed Guide]<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><a><\/a>Common Mistakes in Cross Certificates and Fixes<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The path validation breaks when there is no cross-certificate or it points to the wrong CA. Troubleshooting involves checking the certificate chain via a validation tool. The correct cross certificate needs to be installed in the intermediate store or directory accessible to the relying party.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Name constraints\/pathLenConstraint <\/strong>violations lead to rejection of a valid subject or a too-long path. Name constraints and pathLen values need to be checked on the cross certificate. The cross certificate should be re-issued with broader <strong>nameConstraints <\/strong>or a higher pathLen value.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The relying party rejects a valid path due to policy mapping conflicts. Policy OIDs need to be compared in both certificate policies. The <strong>policyMappings<\/strong> extension should be updated with proper translation of the foreign policy to a local one.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Expired or revoked cross certificates will be found in cached paths. Check the notAfter value and the <a href=\"https:\/\/certera.com\/blog\/ocsp-vs-crl-know-the-difference\/\">CRL\/OCSP<\/a> availability. Delete the old certificate and deploy the new one.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Incorrect trust-anchor configuration prevents the relying party from starting the path. Ensure that the only configured trust anchor is the local root and that the cross certificate properly chains to it. Remove any additional or outdated roots from the trust store.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><a><\/a>Cross Certification Best Practices<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Use restrictive <strong>nameConstraints<\/strong> and <strong>pathLenConstraint<\/strong> values in every cross certificate. This will restrict the foreign CA from certifying names or chain depth outside of the agreed business relationship.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Define explicit certificate policies for both domains and use the <strong>policyMapping<\/strong>s extension for mapping. This will enable relying parties to enforce their own rules easily.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ensure synchronisation of revocation information. Make sure to publish CRLs or OCSP responses that are accessible by both parties to prevent immediate usage of a revoked cross certificate.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Record the trust agreement along with policy mappings, constraints, and contacts. Assess the relationship at regular intervals, either annually or when PKI alters its hierarchy.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In case of several partners, select the Bridge CA. It reduces the network of bilateral certificates to a single relationship and makes further additions easier.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Perform complete testing of path building and validation in a replica environment before issuance of the cross certificates. Detect missing intermediaries or policy differences before it is too late.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Lastly, consider the exit strategy. Once the cooperation ends, the cross certificates should be revoked and removed from the directory. Verify that no trust paths exist.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><a><\/a>Conclusion<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Cross certificates tie disjointed trust islands together into functional chains of trust. They provide interoperability for separate entities, agencies, and industries, each of which maintains control over its own root. Where do isolated roots hinder you from exchanging identity information, documents, or device certificates? You must design an architecture, impose stringent constraints and policy mappings, and explore all paths for full lifecycle management. With this rigour, cross-certificates provide trust, not kludges.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Key Takeaways Introduction Different entities use separate PKIs, and each has a different root of trust. This makes it impossible for users to validate certificates and their identities between trust domains. To solve this problem, cross-certificates come into play, as they make connections between separate trust domains while maintaining certification paths without requiring organisations to<span class=\"morelink d-block mt-3\"><a href=\"https:\/\/certera.com\/blog\/what-is-a-cross-certificate-in-pki-how-does-it-maintain-continuous-trust-chains\/\">Read More<\/a><\/span><\/p>\n","protected":false},"author":1,"featured_media":4795,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[719],"tags":[924,925],"class_list":["post-4794","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-pki","tag-cross-certificates-in-pki","tag-x-509-cross-certificates","entry"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Cross Certificates in PKI Explained: Trust Chains, Benefits &amp; Uses<\/title>\n<meta name=\"description\" content=\"Discover how cross certificates work in PKI, why certificate authorities use cross certification, and how they maintain trust across different root certificate hierarchies.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/certera.com\/blog\/what-is-a-cross-certificate-in-pki-how-does-it-maintain-continuous-trust-chains\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Cross Certificates in PKI Explained: Trust Chains, Benefits &amp; Uses\" \/>\n<meta property=\"og:description\" content=\"Discover how cross certificates work in PKI, why certificate authorities use cross certification, and how they maintain trust across different root certificate hierarchies.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/certera.com\/blog\/what-is-a-cross-certificate-in-pki-how-does-it-maintain-continuous-trust-chains\/\" \/>\n<meta property=\"og:site_name\" content=\"EncryptedFence by Certera - Web &amp; Cyber Security Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/certeraLLC\/\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-10T11:17:06+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-09-10T11:17:07+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/certera.com\/blog\/wp-content\/uploads\/2026\/09\/cross-certificate-in-pki.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"960\" \/>\n\t<meta property=\"og:image:height\" content=\"620\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Janki Mehta\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@certera_llc\" \/>\n<meta name=\"twitter:site\" content=\"@certera_llc\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Janki Mehta\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"9 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/what-is-a-cross-certificate-in-pki-how-does-it-maintain-continuous-trust-chains\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/what-is-a-cross-certificate-in-pki-how-does-it-maintain-continuous-trust-chains\\\/\"},\"author\":{\"name\":\"Janki Mehta\",\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/#\\\/schema\\\/person\\\/e5a476aa90d9e02260ebfe4b0bf046b7\"},\"headline\":\"What is a Cross Certificate in PKI? How it Helps Maintain Continuous PKI Trust?\",\"datePublished\":\"2026-09-10T11:17:06+00:00\",\"dateModified\":\"2026-09-10T11:17:07+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/what-is-a-cross-certificate-in-pki-how-does-it-maintain-continuous-trust-chains\\\/\"},\"wordCount\":1863,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/what-is-a-cross-certificate-in-pki-how-does-it-maintain-continuous-trust-chains\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/certera.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/cross-certificate-in-pki.webp\",\"keywords\":[\"Cross Certificates in PKI\",\"X.509 Cross Certificates\"],\"articleSection\":[\"PKI\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/certera.com\\\/blog\\\/what-is-a-cross-certificate-in-pki-how-does-it-maintain-continuous-trust-chains\\\/#respond\"]}],\"copyrightYear\":\"2026\",\"copyrightHolder\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/what-is-a-cross-certificate-in-pki-how-does-it-maintain-continuous-trust-chains\\\/\",\"url\":\"https:\\\/\\\/certera.com\\\/blog\\\/what-is-a-cross-certificate-in-pki-how-does-it-maintain-continuous-trust-chains\\\/\",\"name\":\"Cross Certificates in PKI Explained: Trust Chains, Benefits & Uses\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/what-is-a-cross-certificate-in-pki-how-does-it-maintain-continuous-trust-chains\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/what-is-a-cross-certificate-in-pki-how-does-it-maintain-continuous-trust-chains\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/certera.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/cross-certificate-in-pki.webp\",\"datePublished\":\"2026-09-10T11:17:06+00:00\",\"dateModified\":\"2026-09-10T11:17:07+00:00\",\"description\":\"Discover how cross certificates work in PKI, why certificate authorities use cross certification, and how they maintain trust across different root certificate hierarchies.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/what-is-a-cross-certificate-in-pki-how-does-it-maintain-continuous-trust-chains\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/certera.com\\\/blog\\\/what-is-a-cross-certificate-in-pki-how-does-it-maintain-continuous-trust-chains\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/what-is-a-cross-certificate-in-pki-how-does-it-maintain-continuous-trust-chains\\\/#primaryimage\",\"url\":\"https:\\\/\\\/certera.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/cross-certificate-in-pki.webp\",\"contentUrl\":\"https:\\\/\\\/certera.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/cross-certificate-in-pki.webp\",\"width\":960,\"height\":620,\"caption\":\"Cross Certificates in PKI\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/what-is-a-cross-certificate-in-pki-how-does-it-maintain-continuous-trust-chains\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/certera.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"What is a Cross Certificate in PKI? How it Helps Maintain Continuous PKI Trust?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/certera.com\\\/blog\\\/\",\"name\":\"EncryptedFence by Certera - Web & Cyber Security Blog\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/#organization\"},\"alternateName\":\"Certera's EncryptedFence Blog\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/certera.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/#organization\",\"name\":\"Certera\",\"url\":\"https:\\\/\\\/certera.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/certera.com\\\/blog\\\/wp-content\\\/uploads\\\/2023\\\/08\\\/logo-encryptedfence.svg\",\"contentUrl\":\"https:\\\/\\\/certera.com\\\/blog\\\/wp-content\\\/uploads\\\/2023\\\/08\\\/logo-encryptedfence.svg\",\"caption\":\"Certera\"},\"image\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/certeraLLC\\\/\",\"https:\\\/\\\/x.com\\\/certera_llc\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/certera-llc\\\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/#\\\/schema\\\/person\\\/e5a476aa90d9e02260ebfe4b0bf046b7\",\"name\":\"Janki Mehta\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcertera.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fhttps-vs-sftp-jpg.webp&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcertera.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fhttps-vs-sftp-jpg.webp&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcertera.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fhttps-vs-sftp-jpg.webp&r=g\",\"caption\":\"Janki Mehta\"},\"description\":\"Janki Mehta is a passionate Cyber-Security Enthusiast who keenly monitors the latest developments in the Web\\\/Cyber Security industry. She puts her knowledge into practice and helps web users by arming them with the necessary security measures to stay safe in the digital world.\",\"sameAs\":[\"https:\\\/\\\/certerassl.com\\\/\"],\"url\":\"https:\\\/\\\/certera.com\\\/blog\\\/author\\\/certerabguser\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Cross Certificates in PKI Explained: Trust Chains, Benefits & Uses","description":"Discover how cross certificates work in PKI, why certificate authorities use cross certification, and how they maintain trust across different root certificate hierarchies.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/certera.com\/blog\/what-is-a-cross-certificate-in-pki-how-does-it-maintain-continuous-trust-chains\/","og_locale":"en_US","og_type":"article","og_title":"Cross Certificates in PKI Explained: Trust Chains, Benefits & Uses","og_description":"Discover how cross certificates work in PKI, why certificate authorities use cross certification, and how they maintain trust across different root certificate hierarchies.","og_url":"https:\/\/certera.com\/blog\/what-is-a-cross-certificate-in-pki-how-does-it-maintain-continuous-trust-chains\/","og_site_name":"EncryptedFence by Certera - Web &amp; Cyber Security Blog","article_publisher":"https:\/\/www.facebook.com\/certeraLLC\/","article_published_time":"2026-09-10T11:17:06+00:00","article_modified_time":"2026-09-10T11:17:07+00:00","og_image":[{"width":960,"height":620,"url":"https:\/\/certera.com\/blog\/wp-content\/uploads\/2026\/09\/cross-certificate-in-pki.webp","type":"image\/jpeg"}],"author":"Janki Mehta","twitter_card":"summary_large_image","twitter_creator":"@certera_llc","twitter_site":"@certera_llc","twitter_misc":{"Written by":"Janki Mehta","Est. reading time":"9 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/certera.com\/blog\/what-is-a-cross-certificate-in-pki-how-does-it-maintain-continuous-trust-chains\/#article","isPartOf":{"@id":"https:\/\/certera.com\/blog\/what-is-a-cross-certificate-in-pki-how-does-it-maintain-continuous-trust-chains\/"},"author":{"name":"Janki Mehta","@id":"https:\/\/certera.com\/blog\/#\/schema\/person\/e5a476aa90d9e02260ebfe4b0bf046b7"},"headline":"What is a Cross Certificate in PKI? How it Helps Maintain Continuous PKI Trust?","datePublished":"2026-09-10T11:17:06+00:00","dateModified":"2026-09-10T11:17:07+00:00","mainEntityOfPage":{"@id":"https:\/\/certera.com\/blog\/what-is-a-cross-certificate-in-pki-how-does-it-maintain-continuous-trust-chains\/"},"wordCount":1863,"commentCount":0,"publisher":{"@id":"https:\/\/certera.com\/blog\/#organization"},"image":{"@id":"https:\/\/certera.com\/blog\/what-is-a-cross-certificate-in-pki-how-does-it-maintain-continuous-trust-chains\/#primaryimage"},"thumbnailUrl":"https:\/\/certera.com\/blog\/wp-content\/uploads\/2026\/09\/cross-certificate-in-pki.webp","keywords":["Cross Certificates in PKI","X.509 Cross Certificates"],"articleSection":["PKI"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/certera.com\/blog\/what-is-a-cross-certificate-in-pki-how-does-it-maintain-continuous-trust-chains\/#respond"]}],"copyrightYear":"2026","copyrightHolder":{"@id":"https:\/\/certera.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/certera.com\/blog\/what-is-a-cross-certificate-in-pki-how-does-it-maintain-continuous-trust-chains\/","url":"https:\/\/certera.com\/blog\/what-is-a-cross-certificate-in-pki-how-does-it-maintain-continuous-trust-chains\/","name":"Cross Certificates in PKI Explained: Trust Chains, Benefits & Uses","isPartOf":{"@id":"https:\/\/certera.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/certera.com\/blog\/what-is-a-cross-certificate-in-pki-how-does-it-maintain-continuous-trust-chains\/#primaryimage"},"image":{"@id":"https:\/\/certera.com\/blog\/what-is-a-cross-certificate-in-pki-how-does-it-maintain-continuous-trust-chains\/#primaryimage"},"thumbnailUrl":"https:\/\/certera.com\/blog\/wp-content\/uploads\/2026\/09\/cross-certificate-in-pki.webp","datePublished":"2026-09-10T11:17:06+00:00","dateModified":"2026-09-10T11:17:07+00:00","description":"Discover how cross certificates work in PKI, why certificate authorities use cross certification, and how they maintain trust across different root certificate hierarchies.","breadcrumb":{"@id":"https:\/\/certera.com\/blog\/what-is-a-cross-certificate-in-pki-how-does-it-maintain-continuous-trust-chains\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/certera.com\/blog\/what-is-a-cross-certificate-in-pki-how-does-it-maintain-continuous-trust-chains\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/certera.com\/blog\/what-is-a-cross-certificate-in-pki-how-does-it-maintain-continuous-trust-chains\/#primaryimage","url":"https:\/\/certera.com\/blog\/wp-content\/uploads\/2026\/09\/cross-certificate-in-pki.webp","contentUrl":"https:\/\/certera.com\/blog\/wp-content\/uploads\/2026\/09\/cross-certificate-in-pki.webp","width":960,"height":620,"caption":"Cross Certificates in PKI"},{"@type":"BreadcrumbList","@id":"https:\/\/certera.com\/blog\/what-is-a-cross-certificate-in-pki-how-does-it-maintain-continuous-trust-chains\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/certera.com\/blog\/"},{"@type":"ListItem","position":2,"name":"What is a Cross Certificate in PKI? How it Helps Maintain Continuous PKI Trust?"}]},{"@type":"WebSite","@id":"https:\/\/certera.com\/blog\/#website","url":"https:\/\/certera.com\/blog\/","name":"EncryptedFence by Certera - Web & Cyber Security Blog","description":"","publisher":{"@id":"https:\/\/certera.com\/blog\/#organization"},"alternateName":"Certera's EncryptedFence Blog","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/certera.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/certera.com\/blog\/#organization","name":"Certera","url":"https:\/\/certera.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/certera.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/certera.com\/blog\/wp-content\/uploads\/2023\/08\/logo-encryptedfence.svg","contentUrl":"https:\/\/certera.com\/blog\/wp-content\/uploads\/2023\/08\/logo-encryptedfence.svg","caption":"Certera"},"image":{"@id":"https:\/\/certera.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/certeraLLC\/","https:\/\/x.com\/certera_llc","https:\/\/www.linkedin.com\/company\/certera-llc\/"]},{"@type":"Person","@id":"https:\/\/certera.com\/blog\/#\/schema\/person\/e5a476aa90d9e02260ebfe4b0bf046b7","name":"Janki Mehta","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcertera.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fhttps-vs-sftp-jpg.webp&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcertera.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fhttps-vs-sftp-jpg.webp&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcertera.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fhttps-vs-sftp-jpg.webp&r=g","caption":"Janki Mehta"},"description":"Janki Mehta is a passionate Cyber-Security Enthusiast who keenly monitors the latest developments in the Web\/Cyber Security industry. She puts her knowledge into practice and helps web users by arming them with the necessary security measures to stay safe in the digital world.","sameAs":["https:\/\/certerassl.com\/"],"url":"https:\/\/certera.com\/blog\/author\/certerabguser\/"}]}},"_links":{"self":[{"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/posts\/4794","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/comments?post=4794"}],"version-history":[{"count":3,"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/posts\/4794\/revisions"}],"predecessor-version":[{"id":4800,"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/posts\/4794\/revisions\/4800"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/media\/4795"}],"wp:attachment":[{"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/media?parent=4794"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/categories?post=4794"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/tags?post=4794"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}