Leaf certificate

A leaf certificate binds a public key to a hostname and is signed by an intermediate. Its maximum lifetime keeps shrinking: the cap fell from 825 days to 398 days on September 1, 2020, and a 2025 CA/Browser Forum ballot steps it down to 47 days by March 2029. A padlock tells you the domain matched, which is exactly what a scammer's lookalike domain also achieves.

How it works

A leaf certificate sits at the bottom of the chain and cannot sign anything else. Its basicConstraints extension sets CA to false, and that flag is the mechanical difference between it and every certificate above it. The hostnames it covers live in the subjectAltName extension; the older common name field is ignored by current clients, so a certificate whose subjectAltName omits the hostname fails even when the common name matches perfectly.

Getting one issued proves less than most people assume. Domain validation, the cheapest and by far the most common level, checks only that whoever asked can place a token at a URL on the domain or publish a DNS record under it. Under the ACME protocol that check finishes in seconds and costs nothing. Organization and extended validation add paperwork about a legal entity, but browsers stopped rewarding the effort: Chrome 77 and Firefox 70 both stripped the company name out of the address bar in the autumn of 2019, so a visitor now sees the same padlock either way.

Two developments do help. Every publicly trusted leaf must be recorded in Certificate Transparency logs, and Chrome has rejected certificates lacking proof of logging since April 30, 2018, so anyone can search those public logs for certificates issued against a domain they own and spot one nobody ordered. The validity squeeze helps too, for a blunt reason: a stolen key stays useful only until the certificate expires, which is why the industry accepted a schedule stepping down to 200 days, then 100, then 47.

Where you see it

A leaf certificate reaches you every time you sign in to an exchange. The leaf is what your browser matches the hostname against, and it is the only link in the chain that says anything at all about the specific site in front of you.

This is where the term earns its keep for anyone buying bitcoin. A phishing page on a typosquatted domain carries a perfectly valid leaf certificate, issued automatically and free, with a genuine padlock beside it. The certificate confirms that your connection really reaches the domain shown in the address bar. It makes no claim that the domain belongs to the company whose logo is on the page. Read the hostname character by character, paying attention to the part immediately before the first single slash, and treat the padlock as a statement about wiring rather than honesty.

Inside BIP70 the leaf did the same job in a different container: it came first in the certificate list, and the signature on the payment request was produced by its private key.

Leaf certificate vs intermediate certificate

A leaf certificate ends the chain; an intermediate continues it. Only one of the two may sign further certificates, and a client that let a leaf sign would accept anything anyone put in front of it. The split also decides where the private key lives. An intermediate key stays inside a hardware module at the authority and signs thousands of certificates over its life. A leaf key sits on the server it identifies, is exposed to whatever that server is exposed to, and gets replaced every time the certificate rotates.