Root certificate

The role of root certificate as in the chain of trust.

In cryptography and computer security, a root certificate is a public key certificate that identifies a root certificate authority (CA).^[1] Root certificates are self-signed and form the basis of an X.509-based public key infrastructure (PKI). For instance, the PKIs supporting HTTPS^[2] for secure web browsing and electronic signature schemes depend on a set of root certificates.

A certificate authority can issue multiple certificates in the form of a tree structure. A root certificate is the top-most certificate of the tree, the private key which is used to "sign" other certificates. All certificates signed by the root certificate, with the "CA" field set to true, inherit the trustworthiness of the root certificate—a signature by a root certificate is somewhat analogous to "notarizing" an identity in the physical world. Such a certificate is called an intermediate certificate or subordinate CA certificate. Certificates further down the tree also depend on the trustworthiness of the intermediates.

The root certificate is usually made trustworthy by some mechanism other than a certificate, such as by secure physical distribution. For example, some of the most well-known root certificates are distributed in operating systems by their manufacturers. Microsoft distributes root certificates belonging to members of the Microsoft Root Certificate Program to Windows desktops and Windows Phone 8.^[2] Apple distributes root certificates belonging to members of its own root program.

References

1. ↑ "What Are CA Certificates?". Microsoft TechNet. 2003-03-28. 
2. 1 2 "Windows and Windows Phone 8 SSL Root Certificate Program (Member CAs)". Microsoft TechNet. October 2014.