Base weakness
Draft
CWE-296: Improper Following of a Certificate's Chain of Trust
The product does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate.
15
Recorded CVEs
With this primary weakness
0
KEVs
In the CISA KEV catalog
Low
Likelihood of exploit
Per MITRE
Base
Abstraction
MITRE classification
Overview
There are several ways in which the chain of trust might be broken, including but not limited to: Any certificate in the chain is self-signed, unless it is the root. Not every intermediate certificate is checked, starting from the original certificate all the way up to the root certificate. An intermediate, CA-signed certificate does not have the expected Basic Constraints or other important extensions. The root certificate has been compromised or authorized to the wrong party.