Root certificate

Every certificate check ends at a root. A root certificate signs itself and is trusted only because it shipped in your device's root store; DST Root CA X3, the best known example, was issued on September 30, 2000 and expired exactly 21 years later. If you judge an exchange by its padlock alone, you are trusting that list of roots rather than anything about the exchange.

How it works

A root certificate names the same organization in both its issuer field and its subject field, and the key that signed it is the key it certifies. That circularity is the point. Nothing above a root vouches for it, so a verifier cannot check it against anything higher up; it can only look the certificate up in a local list and treat the list as authoritative.

Those lists are curated by a handful of companies. Apple, Microsoft, Mozilla and Google each run a root program with published inclusion criteria, audit requirements and removal procedures, and the store on your laptop or phone is whichever one your vendor shipped with the software. Inclusion lasts a very long time, because pulling a root out means shipping an update to every device that holds it. ISRG Root X1, the anchor behind Let's Encrypt, was issued on June 4, 2015 and does not expire until June 4, 2035.

The structural weakness is that any root in the store can vouch for any name. No rule ties a Dutch authority to Dutch domains, so one compromised authority undermines every site at once. DigiNotar proved it in 2011: an attacker issued a fraudulent certificate for google.com on July 10 of that year and used it to intercept traffic belonging to Iranian users. Mozilla, Google and Microsoft pulled the DigiNotar roots in the first days of September 2011, and the company was bankrupt before the month ended.

Where you see it

Root certificates entered bitcoin through BIP70, which asked wallets to validate a merchant's certificate chain up to a trusted root before printing a company name on the payment screen. Desktop software borrowed the operating system store to do it, mobile software frequently got it wrong, and Bitcoin Core deleted the feature outright in release 0.20.0. The bitcoin.org developer reference still lists the term, which is the main reason anyone looks it up now.

The more useful comparison is with bitcoin's own anchor. A full node starts from a genesis block dated January 3, 2009, hard-coded into the software, and verifies every rule for itself from there. Nobody adds an entry to that anchor by pushing an update to your phone, and no authority can be breached or pressured into vouching for a block that breaks the rules. Root stores work in the opposite direction: trust flows downward from a list you did not write and cannot audit.

Root certificate vs leaf certificate

A root certificate identifies a certificate authority; a leaf certificate identifies a server. The root is self-signed, lives for two decades, and keeps its private key in an offline hardware module brought out a few times a year under witness. The leaf names the hostname you actually connected to, lives for months, and its private key sits on a running web server exposed to the internet. People say "the certificate is valid" when they mean the leaf parsed and the dates line up, but the question that decides whether the connection is trustworthy is which root the chain ends at.