What do people mean by "top-down manner" in X.509 certificates?

Question

What do people mean by saying that X.509 certificates work in "top-down manner"? Do they say that because CAs can do cross certifications?

Answer 1

"Top-down" means that certificate validation proceeds from the root CA down to the end-entity certificate (i.e. the certificate you want to validate). This relates to the idea that an X.509 PKI is meant to be hierarchical: at the "top" there is one or a few root CA, which are trusted a priori, and then trust trickles down to the intermediate CA whose certificates have been issued (signed) by a root CA, then to other intermediate CA issued by the previous intermediate CA, and so on, until trust reaches the certificate for an email user or SSL server.

Notions of "up" and "down" are completely arbitrary, of course, but it is traditional to consider that the source of authority and trust is at "the top".

Interestingly, the root of a biological tree is at the bottom; however, in computer science, trees are customarily represented with the root on top, as in this picture (taken from Wikipedia):

By contrast, the PKI structure for which OpenPGP was designed, i.e. the Web of trust, is not "top-down" because it is highly decentralized, so there is no "top" entity.

---

Cross-certification are in fact non-tree-like features; the more cross-certifications you do, the less top-down the PKI becomes. One could say that the Web of trust is a hierarchical PKI with so many cross-certification that the initial, hierarchical structure has become redundant and was bodily removed.