What is a Root Certificate?

Learn what a Root Certificate is, why browsers trust it, how it forms the foundation of SSL security, and its role in the certificate chain.

Reading Time: 5–6 min

What is a Root Certificate?

A Root Certificate is the highest level of trust within the SSL/TLS certificate hierarchy. It is issued by a trusted Certificate Authority (CA) and serves as the foundation for verifying the authenticity of millions of SSL certificates used across the internet.

Every secure HTTPS connection ultimately relies on a trusted Root Certificate.

Without Root Certificates, browsers would have no reliable way to determine whether a website's SSL certificate is genuine.

Why Are Root Certificates Important?

When you visit a secure website, your browser must decide whether it can trust the SSL certificate presented by the server.

It does this by checking whether the certificate can be traced back to a trusted Root Certificate already stored in the browser or operating system.

If a trusted Root Certificate exists, the browser allows the encrypted connection to continue.

If not, you'll likely see a warning such as:

"Your connection is not private."

Where Does a Root Certificate Fit?

Every SSL certificate follows a chain of trust:

Root Certificate

        ↓

Intermediate Certificate

        ↓

Website SSL Certificate

The Root Certificate sits at the top of the hierarchy.

It does not usually sign website certificates directly. Instead, it issues one or more Intermediate Certificates, which then issue SSL certificates for websites.

Why Are Root Certificates Kept Offline?

Root Certificates are among the most valuable assets owned by a Certificate Authority.

To protect them from compromise, they are typically:

• Stored offline

• Protected by strict physical security

• Used only to issue Intermediate Certificates

• Rarely accessed

This reduces the risk of the Root Certificate being stolen or misused.

Who Owns Root Certificates?

Trusted Root Certificates are issued and managed by recognised Certificate Authorities such as:

• DigiCert

• Sectigo

• GlobalSign

• Let's Encrypt

• Entrust

Browsers and operating systems include lists of trusted Root Certificates, known as Root Stores.

Only Certificate Authorities that meet strict security and auditing requirements are included.

What Happens if a Root Certificate Is Not Trusted?

If a browser cannot verify a trusted Root Certificate, it cannot establish the chain of trust.

This may result in:

• Browser security warnings

• HTTPS errors

• Certificate trust failures

• Blocked secure connections

Even if the website certificate itself is valid, the connection will not be trusted unless the Root Certificate is recognised.

Frequently Asked Questions

Does every SSL certificate rely on a Root Certificate?

Yes. Every publicly trusted SSL certificate ultimately traces back to a trusted Root Certificate.

Can a Root Certificate expire?

Yes. Like all digital certificates, Root Certificates have expiration dates, although they typically remain valid for many years.

Can websites install Root Certificates?

No. Websites install their own SSL certificate and any required Intermediate Certificates. Browsers already contain the trusted Root Certificates needed for validation.

Related Articles

• Certificate Chain Explained

• What is an Intermediate Certificate?

• Root vs Intermediate Certificate

• What is a Leaf Certificate?

• Certificate Authority Explained