Multiple roots are created when
This applies to every certificate in the CA hierarchy.
Just to make things more interesting, the revocation list itself (CRL/OCSP) is signed and may have it's own PKI. They may also have their own set of keys. (To verify the verifier?)
In other words,
- The chains discovered while verifying the CRL, Deltas, and OCSP responses also count towards a CA root that is discovered. (note that OCSP verification can be suppressed via
id-pkix-ocsp-nocheck
)
The CA architecture has an effect on the chain-building process. Before a distinct certificate chain is considered valid, the chaining engine builds all chains that are possible with the certificate that is being verified. If an end-entity certificate was generated by a freshly set up CA, the certificate chain is straightforward. However, a certificate that was issued by a renewed CA or where a cross-certification exists between the issuing CA and another CA, multiple certificate chains might exist.
The entire graph of certificate chains is constructed and then ordered by the “quality” of the chain. The best quality chain for a given end certificate is returned to the calling application as the default chain.
Below are illustrations of validation processes in a Single, N-Tier, Cross, and Bridge PKI
Single CA

N Tier

Cross Trust CA

Bridge CA

More information on PKI topology and cert renewals is at the bottom of this article