rootcertificaten

Root certificates are self-signed public keys that serve as trust anchors in a public key infrastructure (PKI). They establish the root of the chain of trust for digital certificates used in secure protocols such as TLS, as well as for code signing and email security. A root certificate is trusted because it is included in software and operating system trust stores and is assumed to be under the control of a reliable certificate authority.

In typical PKI operation, leaf certificates are issued by intermediate certificate authorities that themselves rely on a root certificate. The root certificate is usually kept offline and highly protected, while subordinate CAs and end-entity certificates are used in daily operations. The root’s public key is distributed through trust stores in operating systems, browsers, and devices, enabling clients to verify chains presented by servers and apps.

Root certificates have long validity periods, often decades, but they can be retired or replaced. When a root certificate is compromised or decommissioned, trust stores must be updated to remove trust in that root and to install a new root certificate. Because a compromised root affects many certificates, such updates require coordinated changes across platforms and vendors.

Root certificates do not typically appear in normal TLS handshakes; instead, servers present a chain of certificates that ends in a trusted root. Revocation mechanisms such as CRL or OCSP apply mainly to intermediate and leaf certificates. Security best practices emphasize protected root key material (for example, offline storage and hardware security modules) and routine rotation of subordinate certificates to limit risk.