How in-house certificate authority works (e.g. EJBCA)

Question

I have a simple question with respect to EJBCA. I have been exploring how in-house CAs work and issue certificates. However, I am not able to understand who will be trusted on the top level in a certificate chain.

Let me try to clarify. When I buy a cert from say Comodo, I know that the certificate chain will end up at the Comodo root CA which is trusted by the browsers.

So, in case of EJBCA, which root certificate will be used and how to get that? If purpose of EJBCA is to have full control over the CA, then wouldn't it need a well known root CA which would be trusted by browsers? Also, does it mean, although I have EJBCA on-premise, I still have to purchase a root level cert for my organization from a third party vendor like Comodo?

I know that I am horribly missing some concepts here. However, I tried reading the EJBCA documentation, Google documentation on in-house CA, etc., but they all talk about how to install, configure, manage, etc. My search did not lead me to a documentation which would explain how this whole thing works.

Any pointer to documentation would be really helpful.

Answer 1

What you are describing is basic Public Key Infrastructure.

When you run your own Certification Authority, you have to manage the root CA cert. For it to be recognised, you have to deploy it to your clients, which can be done using the "well known root CA" of browsers, but won't be until you can get recognised as a proper CA (see here).

Answer 2

Basically you self sign your own CA certificate. The public key of this self signed certificate is added to the list of CA's in the host systems of your companys devices. This can be done using centralized software distributon and configuration. Now your self signed CA appears to be a valid root certificate that can be used for chains.