rotsertifikatet

Rotsertifikatet, commonly referred to as a root certificate, is the highest level of a digital certificate in a public key infrastructure (PKI). It acts as the anchor of trust for a hierarchy of certificates that verify identities and enable secure communications. A root certificate is typically self-signed, meaning the issuer and subject are the same authority, and it contains the root’s public key, identifying details, and its validity period. Because root certificates are trusted by software and operating systems, they underpin the trust model for TLS, code signing, S/MIME, and other PKI-based services.

Root certificates are distributed as trust anchors in major software and operating system trust stores and are maintained by certificate authorities. They are updated through vendor updates and, in turn, allow devices to validate certificate chains presented by websites, services, and applications. When a certificate is encountered, the system builds a chain from the presented certificate up to a trusted root. If the chain cannot be validated to a trusted root, the certificate or connection is treated as untrusted.

Managing root certificates involves governance, robust protection of private keys, and procedures for revocation or replacement. Root keys are highly protected, often stored in hardware security modules and kept offline to minimize exposure. While revocation of subordinate certificates is common, removing or distrusting a root certificate is rare and requires coordinated updates across devices and software. Ongoing trust-store maintenance, audits, and policy compliance are essential to maintain the integrity of the PKI ecosystem.