I have a simple question with respect to EJBCA. I have been exploring how in-house CAs work and issue certificates. However, I am not able to understand who will be trusted on the top level in a certificate chain.
Let me try to clarify. When I buy a cert from say Comodo, I know that the certificate chain will end up at the Comodo root CA which is trusted by the browsers.
So, in case of EJBCA, which root certificate will be used and how to get that? If purpose of EJBCA is to have full control over the CA, then wouldn't it need a well known root CA which would be trusted by browsers? Also, does it mean, although I have EJBCA on-premise, I still have to purchase a root level cert for my organization from a third party vendor like Comodo?
I know that I am horribly missing some concepts here. However, I tried reading the EJBCA documentation, Google documentation on in-house CA, etc., but they all talk about how to install, configure, manage, etc. My search did not lead me to a documentation which would explain how this whole thing works.
Any pointer to documentation would be really helpful.