thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Fundamentals & Crypto · Foundational

Root Certificate Authority (Root CA)

The top-level CA in a hierarchy whose self-signed certificate is the trust anchor for all subordinate certificates.

Definition

The root CA certificate is self-signed and distributed in trust stores. Because compromise of the root breaks the entire hierarchy, root CAs are usually kept offline and used only to sign intermediate CA certificates and CRLs. Root certificates typically have long validity periods.

Example

A company keeps its root CA on an air-gapped server in a safe and powers it on only to renew intermediate certificates.

Exam tip

Best practice: keep the root CA offline and issue end-entity certificates from intermediates.

Related terms