thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Fundamentals & Crypto · Intermediate

Offline Root CA

A root certificate authority kept powered off or disconnected from networks to protect its private key.

Definition

Offline root CAs are brought online only to sign subordinate CA certificates or publish CRLs, often during formal key ceremonies. This drastically reduces exposure to network attacks. The root's CRL must still be published to an accessible location on a regular schedule.

Example

An offline root CA is booted twice a year to publish a new CRL that is copied by USB to the web distribution point.

Exam tip

Remember to schedule CRL publication for offline roots or validation of the whole chain can fail.

Related terms