The system of CAs with the root-CAs and their subordinate CAs are IMHO in principle akin to the system of banks with their main sites and subsidiries. In the case of banks, a customer of a bank commonly has trust for that bank but not necessarily trust for the other banks of the world. Anything from the other banks can thus be trustworthy for him only through an corresponding action of his bank that provides him the required trust. This implies that the root-CAs must somehow manange to trust one another in order that certificates from the region of one root-CA could be used in the region of other root-CAs. How is that trust among the root-CAs actually being established in practice?

  • Wow...i was just thinking to ask a question on how cross border PKI works. – Shurmajee Jun 23 '13 at 14:27

Root CA don't trust each other and don't actually talk to each other. Each root CA lives in its own world, alone. Root CA don't trust anybody; it goes the other way round. That's also where the bank analogy breaks down: banks have to talk to each other, while root CA totally ignore each other.

You (or your OS or browser) trusts one or several root CA for asserting things about identities and public keys. The various roots don't have to assume or even be aware that you are trusting several of them simultaneously. It is your problem, not theirs. In practice, your OS or browser vendor has chosen for you that you will trust about one hundred root CA, which you can see by inspecting your browser configuration menus.

Cross-trust between CA is a rare event, which typically happens in the wild as an aftermath of mergers: two businesses, each with its own internal CA, decide to fuse into a single entity. But deployed desktop systems in what formerly was business A only trust rootA, while deployed systems from business B only trust rootB. The ideal solution would be to modify all systems so that they all trust both rootA and rootB, but that's hard work (depending on how computers are managed in the organization, they may have to send sysadmins in front of each of the thousands of PC, to do the few needed operations) and it may take time. So, in the meantime, something can be done at the CA level: make rootA emit a certificate (an intermediate CA certificate) for rootB (and vice-versa). This means that rootA asserts that whoever trust rootA may also trust that which comes from rootB (and vice-versa).

Some people have invested a lot of thought into coming up with terminology for the various cases of cross-trust; see RFC 5217 for (a lot of) details. However, I insist, this does not happen often in the "real world".


This implies that the root-CAs must somehow manange to trust one another

That is not how trust works in the X.509 model at all.

A user trusts many root CAs directly, through their client's SSL settings. Each root operates independently - they do not trust each other.

If you go to site-A.com and your browser doesn't trust any root or intermediary CA on its certificate chain, you are out of luck. There is no mechanism to take someone else's word for it.

(There are other models based on multiple notaries or webs of trust, but X.509 is mostly where we are today.)

  • If I have an electronic document, how could I achieve that my unkown business partner be convinced that it is authentic, i.e. equivalent to the case a signature of mine being put by me on a peice of paper? Are such matters outside the activities of CAs? – Mok-Kong Shen Jun 23 '13 at 13:09
  • Addendum: Based on what informations an average user trust one or many root CAs? (Because they have nice-sounding names? I hope that's not the case.) – Mok-Kong Shen Jun 23 '13 at 13:14
  • Not even that much - an average user blindly trusts the CA list supplied by their browser/OS vendor. It is very unusual for a consumer to change the defaults. For document signing you would typically exchange PGP keys, and if you wanted to ensure authenticity that would have to involve at least one trusted third party. That could be a CA, either directly or indirectly (eg you download my PGP key from an HTTPS server). It is up to the business partner whether they consider that sufficient proof of authenticity; there is not a globally-accepted legal standard for this. – bobince Jun 23 '13 at 16:02
  • In the browser case I wonder why would one in such situations need the "certificates" at all. They are defacto a valueless nuissance, isnt't it? I remember to have read (long ago) that (electronic) document authenticaion was a big achievment of PKI. So that goal has never been achieved in reality, right? – Mok-Kong Shen Jun 23 '13 at 16:14
  • It has been achieved in many specific cases, where partners or wider industry groups have agreed their own PKI for document signing between each other (with PGP or similar). In the browser case you certainly do need assurance that the site you're connecting to is who they say they are, and CAs are all we have for that at the moment. There are all sorts of serious problems with the web PKI but I wouldn't go so far as to call certs valueless. – bobince Jun 23 '13 at 20:14

As the other answers have mentioned, Root CAs aren't obliged to trust each other. That is considered "your" responsibility*.

But there is also currently a fundamental technical constraint, even if we or they wanted to establish Root CA cross-verification: X509 certificates don't allow for multiply-rooted signature trust chains.

So you can't get a certificate signed by multiple elsewise disparate Root CAs; you are forced to pick one and only one Root CA like a rabbit out of a hat. Which is in part why the browser and operating system vendors put so many Root CAs in the hat; with little or no earnest attempt to check for rabies.

At best, if everyone wanted to do this** with existing version 3 of X.509 they would have to treat all certificate permutations of A -> B -> C -> ... -> Z as equivalent, to get a multi-root signature of Z.

* Well, not your's but your browser and operating system vendor's responsibility at any rate. I hope you trust those vendors.
** The Root CA providers don't want to do this. It would undermine both their business model and oligopoly.


For SSL, the user trusts the browser manufacturer, because there are lots of CAs listed as trusted per default. A security-aware user would remove all root CAs and just add those that he personally trusts.

For Windows, the CAs are stored in the "trusted root authorities" which means that any certificate issued by any of these CAs (for code signing or whatever) can be trusted. So the same applies there too.

The CA system means that the user has to trust some CA that they only issue certificates to people that really are who they say they are (or whatever the certificate says). So from then on you can establish a secure connection or know the code was really signed by that person.

  • But according to bobince: "If you go to site-A.com and your browser doesn't trust any root or intermediary CA on its certificate chain, you are out of luck." I understand this to mean that I can't "arbitrarily" choose a CA that I personally (especially) prefer. – Mok-Kong Shen Jun 23 '13 at 19:40
  • Correct. All root CAs are "root" by definition, so they don't trust each other. If we wanted that, we would need to create a "global root" certificate where all CAs get their certificate from. But that will never happen, all CAs are independent and you can chose which you trust and which not. If the site you visit was created by another one, you're out of luck, as you have to trust the creator of the that certificate. – http Jun 23 '13 at 21:25
  • I trust the bank where I have an account. I don't need to worry about anything of any other banks at all, yet there is no problem of my money transfer to or from any point of the world. This would IMHO mean that there is in fact a "nearly" global bank. If not a single global root-CA, couldn't a few big root-CAs be a practically realizable goal? Suppose there are only 5 root-CAs. Then one could have the option of only using a CA under one of the 5 root- CAs or simultaneously using a CA under each of the 5 root-CAs, though at a higher cost. Could you please comment on that "speculation" of mine? – Mok-Kong Shen Jun 24 '13 at 1:31
  • CAs issue certificates by identifying their clients. This means that the end user trusts the CA to correctly identify the client (your bank for example). It doesn't matter if you trust your bank or not. CAs are hierarchical. So anything at the top of the hierarchy must be trusted by you directly. If you say you would trust your bank (and everyone would) then the bank could issue their own certificates and a different CA would not be needed. There is no such concept of "trusting each other" defined. – http Jun 26 '13 at 22:30
  • What I meant is: If I transfer money from my bank to be pay out by another bank to my partner, I need only trust my bank and need not care whether the other bank is good or not. There is apparently nothing analogous with the CAs. – Mok-Kong Shen Jun 27 '13 at 8:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.