2

These terms come from the Keychain Access utillity on macOS High Sierra.

The Root certificate authority contains information about the Country, Location, Email-address, etc. of the origin, while the second contains a Serial number and a version in the Subject and Issuer information.

Are these the same things? Can there be root certificates that are not self-signed? I thought "Self-signed root certificate" would be a tautology.

  • Actually, the terms come from public key infrastructure. The key difference between a Root CA and a self-signed certificate is the word "authority" - one who is trusted. – user138899 Oct 12 '18 at 16:40
1

Your question appears to morph as one reads through from topic to body. It starts with:

What is the difference between a self-signed root certificate and a root certificate authority?

The self-signed root certificate is the certificate that the root certificate authority publishes and can be used to verify 'customer' certificates issued by the certificate authority.

It ends with:

Can there be root certificates that are not self-signed?

The nature of root certificates is that they are at the 'end of the chain' so by implication they can only be self-signed.

In the middle it becomes a little muddled, I assume in the following:

The Root certificate authority contains information about the Country, Location, Email-address, etc. of the origin, while the second contains a Serial number and a version in the Subject and Issuer information.

If you are referring to the Subject Name and Issuer Name sections of a root certificate when displayed using Keychain Access, then yes the details will be the same because it is a (self-signed) root certificate.

1

The Root certificate authority contains information about the Country, Location, Email-address, etc. of the origin, while the second contains a Serial number and a version in the Subject and Issuer information. Are these the same things?

No, the properties you listed are not the same. A certificate must have a Subject and Issuer and it may additionally contain a Country, Location and Email-address, etc. What is included in a certificate depends on its type and what the owner wants in it.

Can there be root certificates that are not self-signed? I thought "Self-signed root certificate" would be a tautology.

Let's take a look.

A self-signed certificate is just that. A certificate signed by the private key, which is the pair of the public key embedded in the certificate. When building a trust chain, this type of certificate can only appear at the root of the chain as it cannot have anything after it (since it is signed by itself). Here comes the twist. The trust chain building will stop when a trusted-root certificate is encountered. This is trusted-root is always self-signed.

However, there exists a special case when a CA who newly enters the field publishes its "root" certificate which is not self-signed, but cross certified by a well established CA, making it an intermediate certificate. This allows the new CA to start operations before its real root certificate is distributed to the browsers and OS trust stores. A great example of this is Let's Encrypt's root certificates. They are cross certified by IdenTrust.

To sum it up, yes self-signed certificates are by definition root certificates, making it a tautology.

0

It's all about terminology. Certificate chains represent tree graph data structure. Tree structure always has a special vertex/node with no incoming edges (there are only outgoing edges) called root. This is what means in certificate chains: root certificate is the most top certificate with no parent. Since, there is no parent (no signers) for a root, it is self-signed. Thus, "self-signed root" is a tautology.

  • Since edges represent signatures wouldn't a self-signed certificate have an edge to itself? Or are certificates with no signature considered self-signed? – AndrolGenhald Aug 31 '17 at 18:00
  • Not really. Edge is a Subject/Issuer field combination. They define relationship between two nodes Parent-Child (Issuer-Subscriber). Signature is just a mechanism to validate connection integrity between nodes. Edge to itself will cause a loop. Loops are not allowed in trees. Once you hit root node, path building is stopped. – Crypt32 Aug 31 '17 at 18:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.