13

These terms come from the Keychain Access utillity on macOS High Sierra.

The Root certificate authority contains information about the Country, Location, Email-address, etc. of the origin, while the second contains a Serial number and a version in the Subject and Issuer information.

Are these the same things? Can there be root certificates that are not self-signed? I thought "Self-signed root certificate" would be a tautology.

Improve this question
1
  • Actually, the terms come from public key infrastructure. The key difference between a Root CA and a self-signed certificate is the word "authority" - one who is trusted.
    – user138899
    Commented Oct 12, 2018 at 16:40

4 Answers 4

Reset to default
11

The Root certificate authority contains information about the Country, Location, Email-address, etc. of the origin, while the second contains a Serial number and a version in the Subject and Issuer information. Are these the same things?

No, the properties you listed are not the same. A certificate must have a Subject and Issuer and it may additionally contain a Country, Location and Email-address, etc. What is included in a certificate depends on its type and what the owner wants in it.

Can there be root certificates that are not self-signed? I thought "Self-signed root certificate" would be a tautology.

Let's take a look.

A self-signed certificate is just that. A certificate signed by the private key, which is the pair of the public key embedded in the certificate. When building a trust chain, this type of certificate can only appear at the root of the chain as it cannot have anything after it (since it is signed by itself). Here comes the twist. The trust chain building will stop when a trusted-root certificate is encountered. This is trusted-root is always self-signed.

However, there exists a special case when a CA who newly enters the field publishes its "root" certificate which is not self-signed, but cross certified by a well established CA, making it an intermediate certificate. This allows the new CA to start operations before its real root certificate is distributed to the browsers and OS trust stores. A great example of this is Let's Encrypt's root certificates. They are cross certified by IdenTrust.

To sum it up, yes self-signed certificates are by definition root certificates, making it a tautology.

Improve this answer
3

Yes, root certificates are always self-signed and self-issued.

A great example of this is Let's Encrypt's root certificates. They are cross certified by IdenTrust.

Those are not root certificates. Only IdenTrust and ISRG Root X1 are root (there is also ISRG Root X1 signed by DST Root CA X3, DST Root CA X3 has expired after 30th September 2021 14 UTC). But, after AddTrust "suddenly" expired -- it turned out that it is a real problem... It turns out that according to RFC 4158 -- we can trust as root intermidiate certificates and not reissue them as root (though it should happen and happened here) or resign them with a new root, like AAA root. Also, AddTrust is still not expired for esignature for programs, that is a real problem, IMHO. https://crt.sh/?spkisha256=942a6916a6e4ae527711c5450247a2a74fb8e156a8254ca66e739a11493bb445

Improve this answer
1

It's all about terminology. Certificate chains represent tree graph data structure. Tree structure always has a special vertex/node with no incoming edges (there are only outgoing edges) called root. This is what means in certificate chains: root certificate is the most top certificate with no parent. Since, there is no parent (no signers) for a root, it is self-signed. Thus, "self-signed root" is a tautology.

Improve this answer
2
  • Since edges represent signatures wouldn't a self-signed certificate have an edge to itself? Or are certificates with no signature considered self-signed?
    – AndrolGenhald
    Commented Aug 31, 2017 at 18:00
  • Not really. Edge is a Subject/Issuer field combination. They define relationship between two nodes Parent-Child (Issuer-Subscriber). Signature is just a mechanism to validate connection integrity between nodes. Edge to itself will cause a loop. Loops are not allowed in trees. Once you hit root node, path building is stopped.
    – Crypt32
    Commented Aug 31, 2017 at 18:08
1

Your question appears to morph as one reads through from topic to body. It starts with:

What is the difference between a self-signed root certificate and a root certificate authority?

The self-signed root certificate is the certificate that the root certificate authority publishes and can be used to verify 'customer' certificates issued by the certificate authority.

It ends with:

Can there be root certificates that are not self-signed?

The nature of root certificates is that they are at the 'end of the chain' so by implication they can only be self-signed.

In the middle it becomes a little muddled, I assume in the following:

The Root certificate authority contains information about the Country, Location, Email-address, etc. of the origin, while the second contains a Serial number and a version in the Subject and Issuer information.

If you are referring to the Subject Name and Issuer Name sections of a root certificate when displayed using Keychain Access, then yes the details will be the same because it is a (self-signed) root certificate.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .