A root certificate is a self-signed certificate for a trusted certificate authority (CA). Its public key anchors certificate validation, and operating systems, browsers, or language runtimes usually install it in a trust store. section 8.2.1 section 8.3
Trust is established by following a chain from an end-entity certificate, such as github.com, through an intermediate CA to a trusted root. The root is normally not used directly to issue every server certificate; intermediates provide a safer hierarchy. section 8.2.1 section 8.4
When verification cannot find the root
Running `openssl verify github-cert.pem` can produce `unable to get local issuer certificate`. Supplying the appropriate CA material allows OpenSSL to build the chain and report `github-cert.pem: OK`; the displayed chain ends at DigiCert Global Root CA. section 8.2.1
openssl genpkey -algorithm RSA -outform PEM -out ca/ca_private_key.pem
Generate the private key for a local development CA with OpenSSL before creating its self-signed root certificate. section 9.2.1
openssl req -x509 -new -key ca/ca_private_key.pem -days 3650 -out ca/ca_cert.pem -subj "/CN=local-dev CA"
Create a ten-year self-signed local-development CA certificate named local-dev CA. section 9.2.1
Inspect a generated root certificate before trusting or using it. Check that Subject and Issuer match, confirm its validity period and public key, and verify CA extensions such as Basic Constraints: CA:TRUE and suitable key usage. section 9.2.1
