An
SSL root certificate is a certificate issued by a trusted certificate authority
(CA).
In
the SSL ecosystem, anyone can generate and use a signing key to sign a new
certificate. However, such a certificate is not considered valid unless it is
signed directly or indirectly by a trusted CA.
A
trusted certificate authority is an entity that has the right to verify the
identity of who it claims to be. For this model to work, each participant must
agree on a set of trusted CAs. All operating systems and most web browsers
carry a set of trusted CAs.
The
SSL ecosystem is based on a trust relationship model, also known as a
"chain of trust." When a tool validates a certificate, it compares
the issuer of the certificate against the list of trusted CAs. If no matches
are found, the client checks to see if the issued CA certificate was issued by
a trusted CA and goes to the end of the certificate chain. The top of the
chain, the base certificate, must be provided by a trusted certificate
authority.
No comments:
Post a Comment