Certificate chaining

Certificate-based authentication is used during IKE negotiation. In large networks, multiple certificate authorities (CAs) may issue certificates to different devices. Instead of requiring all devices to use a single CA, certificate chains allow verification using a sequence of certificates: the end-entity (device), intermediate CAs, and a root CA. During negotiation, devices can exchange these chains to establish trust. For authentication to succeed, peers must share at least one trusted CA in their chains (not necessarily the root). The total chain length, including all certificates, is limited to 10.