When I look at the trusted certificates in my browser, I see that many certificate authorities have multiple root certificates associated with them. For example, org-Amazon has Amazon Root CA 1, Amazon Root CA 2, Amazon Root CA 3, and Amazon Root CA 4.

How do the purposes of these four certificates differ?

I also see that some CAs have root certificates of different "tiers", such as gold, silver, and platinum. What's the deal with these? I imagine there are price differences associated with the different tiers, but what extra service could they be offering?

  • 1
    Good question. I gave some details regarding Amazon below. I suggest you split off the gold/silver/platinum part into a question of its own so that it can be answered separately. Commented Aug 10, 2020 at 8:07

2 Answers 2


Numerous public CAs have multiple root certificates in trust store for different reasons and largely depends on their business operations. Often roots from same vendor differ by:

  • List of usages
  • Public key or signature algorithm support
  • Assurance level
  • Redundancy

For example, Amazon Root CA 2 and Amazon Root CA 4 allows Code Signing certificates in their chains, while Amazon Root CA 1 and Amazon Root CA 3 do not allow such. This is "EKU" separation.

Amazon Root CA 1 and Amazon Root CA 3 share same list of usages, but they use different public key and signature algorithms: Amazon Root CA 1 and Amazon Root CA 2 use RSA public key, Amazon Root CA 3 and Amazon Root CA 4 use ECC public key.

This setup provides good level of flexibility, compatibility and security.


Amazon lists 5 root CA on https://www.amazontrust.com/repository/ :

Now I think "Starfield" was the CA that they bought to get into the CA game. And the other 4 Amazon made themselves.

And one difference I see is that CAs 1-4 all have different key types. (Key Type 2048-bit RSA, Key Type 4096-bit RSA, Key Type ECDSA (P-256), Key Type ECDSA (P-384).) That is a significant difference between then. Maybe there also are OTHER differences (such as intended usage maybe). But the key type alone makes the four CAs very different from one another.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .