Two-tier CA

Also written: two-tier certificate authority

A PKI where an offline root CA signs only an intermediate CA, and the intermediate signs everyday certificates. If the intermediate's key is compromised, you revoke just the intermediate and the root stays trusted.