Why would a certificate authority have multiple root certificates?

Question

When I look at the trusted certificates in my browser, I see that many certificate authorities have multiple root certificates associated with them. For example, org-Amazon has Amazon Root CA 1, Amazon Root CA 2, Amazon Root CA 3, and Amazon Root CA 4.

How do the purposes of these four certificates differ?

I also see that some CAs have root certificates of different "tiers", such as gold, silver, and platinum. What's the deal with these? I imagine there are price differences associated with the different tiers, but what extra service could they be offering?

Answer 1

Numerous public CAs have multiple root certificates in trust store for different reasons and largely depends on their business operations. Often roots from same vendor differ by:

• List of usages
• Public key or signature algorithm support
• Assurance level
• Redundancy

For example, Amazon Root CA 2 and Amazon Root CA 4 allows Code Signing certificates in their chains, while Amazon Root CA 1 and Amazon Root CA 3 do not allow such. This is "EKU" separation.

Amazon Root CA 1 and Amazon Root CA 3 share same list of usages, but they use different public key and signature algorithms: Amazon Root CA 1 and Amazon Root CA 2 use RSA public key, Amazon Root CA 3 and Amazon Root CA 4 use ECC public key.

This setup provides good level of flexibility, compatibility and security.

Answer 2

Amazon lists 5 root CA on https://www.amazontrust.com/repository/ :

• CN=Amazon Root CA 1,O=Amazon,C=US
• CN=Amazon Root CA 2,O=Amazon,C=US
• CN=Amazon Root CA 3,O=Amazon,C=US
• CN=Amazon Root CA 4,O=Amazon,C=US
• CN=Starfield Services Root Certificate Authority - G2,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Now I think "Starfield" was the CA that they bought to get into the CA game. And the other 4 Amazon made themselves.

And one difference I see is that CAs 1-4 all have different key types. (Key Type 2048-bit RSA, Key Type 4096-bit RSA, Key Type ECDSA (P-256), Key Type ECDSA (P-384).) That is a significant difference between then. Maybe there also are OTHER differences (such as intended usage maybe). But the key type alone makes the four CAs very different from one another.