For example, some of the best-known root certificates are distributed in operating systems by their manufacturers. The root certificate is usually made trustworthy by some mechanism other than a certificate, such as by secure physical distribution. Certificates further down the tree also depend on the trustworthiness of the intermediates. Such a certificate is called an intermediate certificate or subordinate CA certificate. All certificates signed by the root certificate, with the 'CA' field set to true, inherit the trustworthiness of the root certificate-a signature by a root certificate is somewhat analogous to 'notarizing' identity in the physical world. A root certificate is the top-most certificate of the tree, the private key which is used to 'sign' other certificates.

For instance, the PKIs supporting HTTPS for secure web browsing and electronic signature schemes depend on a set of root certificates.Ī certificate authority can issue multiple certificates in the form of a tree structure.

Either it has matched Authority Key Identifier with Subject Key Identifier, in some cases there is no Authority Key identifier, then Issuer string should match with Subject string ( RFC 5280). Root certificates are self-signed (and it is possible for a certificate to have multiple trust paths, say if the certificate was issued by a root that was cross-signed) and form the basis of an X.509-based public key infrastructure (PKI). In cryptography and computer security, a root certificate is a public key certificate that identifies a root certificate authority (CA). The role of root certificate as in the chain of trust.

Microsoft root certificate update