Glossary: Change Records, Cryptography and PKI

root CA

Also written: root certificate, root CAs, root

The top CA, whose self-signed root certificate sits in trust stores. Its private key is kept offline, often in an HSM, and it signs intermediate CAs.