Cyberstudy
PDF p.59 In progress

Root of Trust

Open PDF at p.59 12 flashcards

Summary

PDF p.59

The root of trust model establishes trust between users and certificate authorities (CAs) by using root certificates. A root certificate is self-signed by the CA and used to sign other certificates. Trust models can be single CA or hierarchical, with third-party CAs often using the latter. Self-signed certificates are used in specific scenarios but are generally less secure.

In plain words

Supplementary — not from your PDF

Trust starts at a root certificate that the CA signs itself. Most CAs use a hierarchy: the root signs intermediate CAs, and those sign everyday certificates. So a compromised intermediate doesn't bring the whole system down.

Detailed explanation

PDF p.59
  • Root Certificate
    • Definition: A certificate issued and self-signed by a CA.
    • Key Size: Uses RSA key sizes of 2,048 or 4,096 bits or the ECC equivalent.
    • Subject: Set to the organization/CA name (e.g., "CompTIA Root CA").
  • Trust Model
    • Single CA
      • Model: A single root CA issues certificates directly to users and computers.
      • Risk: If compromised, the entire PKI collapses.
    • Hierarchical Model
      • Structure: Root CA issues certificates to intermediate CAs, which then issue certificates to end entities.
      • Advantages: Allows for clear certificate policies and traceable certification paths (certificate chaining).
  • Self-Signed Certificates
    • Usage: Deployed when PKI is too difficult or expensive to manage.
    • Examples: Used in web administrative interfaces of consumer routers and in development/test environments.
    • Trust Issues: Marked as untrusted by operating systems or browsers, difficult to validate, not recommended for critical hosts and applications.

Important terms

taken from the text above
Root Certificate
A certificate issued and self-signed by a CA.
Key Size
Uses RSA key sizes of 2,048 or 4,096 bits or the ECC equivalent.
Subject
Set to the organization/CA name (e.g., "CompTIA Root CA").
Model
A single root CA issues certificates directly to users and computers.
Trust Issues
Marked as untrusted by operating systems or browsers, difficult to validate, not recommended for critical hosts and applications.

Examples & real-world scenarios

Supplementary — not from your PDF
  • Root CA → intermediate CA → www.example.com (a certificate chain).
  • Self-signed certificates on home routers and in test environments.
  • Root keys kept offline and heavily protected.

Scenario

An intermediate CA is compromised. Because the root is kept offline and only signs intermediates, the CA revokes that intermediate and issues a new one. Certificates chained to other intermediates keep working.

Common mistakes

Supplementary — not from your PDF
  • Using self-signed certificates on important public services.
  • Forgetting to install intermediate certificates on a server, which breaks the chain for some clients.

Practical skills

Supplementary — not from your PDF
  • Trace a certificate chain to its root.

What I should remember

Key Points PDF p.59
  • Root Certificate
    • Self-Signed: Issued by CA to itself.
    • Key Size: RSA 2,048 or 4,096 bits, ECC equivalent.
    • Subject: Organization/CA name.
  • Trust Model
    • Single CA
      • Direct Issuance: Certificates issued directly by root CA.
      • Risk: Single point of failure.
    • Hierarchical Model
      • Intermediate CAs: Issue certificates to end entities.
      • Certificate Chaining: Traceable path to root CA.
  • Self-Signed Certificates
    • Usage: When PKI is impractical.
    • Examples: Consumer routers, development/test environments.
    • Trust Issues: Marked as untrusted, difficult to validate.