Root certificate
A root certificate is a trusted certificate, typically self-signed, that serves as a trust anchor for validating a certificate chain and authorizing subordinate certificates.
Software Security for Developers
A root certificate authority is a self-signed certificate authority whose trust anchor is typically preinstalled in an operating system or other trust store.
- How it is used
- Anchors X.509 certificate validation by providing a preinstalled CA public key for building a trusted chain.
- How deep it goes
- Explains self-signing, trust stores, intermediates, chain verification, and local creation, but stops short of cryptographic proofs.
- Examples
- Uses github.com verification, DigiCert chain inspection, Ubuntu trust-store listings, and a local-dev CA created with OpenSSL.
- What you can do after
- Diagnose certificate-chain failures with OpenSSL and create or inspect a self-signed root certificate for local development.
Read how Software Security for Developers explains root certificate →
ASP.NET Core in Action, 3e
A root certificate is a trust-anchor certificate issued by or representing a certificate authority at the top of a certificate chain.
- How it is used
- Explains why browsers accept or reject HTTPS certificates during ASP.NET Core development and production deployment.
- How deep it goes
- Defines certificate-chain trust, distinguishes development from production certificates, and gives a trust command without detailing certificate internals.
- Examples
- Uses ASP.NET Core development certificates, browser warnings, and `dotnet dev-certs https --trust`.
- What you can do after
- Operate local HTTPS by trusting an ASP.NET Core development certificate and recognize why production requires a CA-signed certificate.
Read how ASP.NET Core in Action, 3e explains root certificate →
Google Anthos in Action
A root certificate is a self-signed certificate that anchors a certificate authority trust chain.
- How it is used
- Anchors Istio workload identities and certificates so mesh services can communicate securely within a zero-trust posture.
- How deep it goes
- Explains self-signing, CA delegation, and three Istio configuration choices without detailing certificate issuance internals.
- Examples
- Uses Istio’s default self-signed CA and an enterprise CA configured with an existing root or delegated signing certificate.
- What you can do after
- Configure Istio certificate management with generated, administrator-specified, or delegated organizational signing material.
Read how Google Anthos in Action explains root certificate →
Related concepts
- certification authoritykind of · A certification authority is a trusted entity that verifies identities and issues digitally signed certificates binding public keys to identities or domains.
- certificatekind of · A digital certificate is a digitally signed credential that binds an identity to a public key and supports authentication or secure communication.
- certificate chainpart of · A certificate chain is an ordered sequence of digital certificates linking an end-entity certificate through intermediate authorities to a trusted root certificate.
- OpenSSLproduced by · OpenSSL is an open-source software library and toolkit implementing cryptographic algorithms, secure-communication protocols, and operations involving keys and certificates.
- trust storeused by · A trust store is a repository of certificates or public keys that a system accepts as trusted when validating identities or secure communications.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.