rootCAs

RootCAs, or root certificate authorities, are the foundational authorities in public key infrastructure (PKI). A root CA issues a self-signed certificate that acts as the trust anchor for a certificate hierarchy used to authenticate entities and establish encrypted communications.

In TLS and other PKI applications, clients maintain a trust store containing trusted root certificates. When a server presents a certificate, clients build a chain of trust from the server certificate to one of the trusted roots, typically via one or more intermediate CAs. If the chain cannot be anchored to a trusted root, the certificate is not trusted.

Root certificates are highly protected because their compromise would affect many entities. Private keys are often stored in hardware security modules and require strict procedures for creation, storage, and rotation. Root programs and policy requirements (for example, CA/Browser Forum Baseline Requirements) guide issuance and security practices. Cross-signing and periodic root key rollovers are used to maintain compatibility and limit risk.

Trust stores are maintained by operating system distributors and major browsers, and differ across platforms. When a root is found to be insecure or non-compliant, it is removed from trust stores through updates or remediation processes.

Examples and scope of root CAs include roots from major providers such as DigiCert, GlobalSign, Entrust, Sectigo, and platform roots from Apple and Microsoft. Root CAs play a central role in digital trust, and their governance and reliability are critical to secure Internet communications.