A root store, or trust store, is the set of root CA certificates that a platform accepts as trust anchors. A server certificate is valid for a client only if its chain ends at a root in that client's store.
Why it matters
There is no single global list. Apple, Microsoft, Mozilla and Google each run a root program with their own inclusion rules, and Chrome, Firefox and others may use their own store or the operating system's. Java, Node.js, Python and many appliances bring bundles of their own.
This explains why a site can look fine in one place and fail in another. An older device that never received an update may lack a newer root, while a root removed after a CA misbehaved stops working in updated clients. When you choose a CA, check that its root is widely included and has a long remaining life.
Example
Check which bundle a Linux system uses and test against it:
openssl version -d
curl --cacert /etc/ssl/certs/ca-certificates.crt https://example.comIf curl succeeds with that bundle but an embedded app fails, the app is probably using an outdated store.
Common mistakes
- Adding a private CA to the system store and forgetting that containers or runtimes keep separate bundles.
- Disabling verification to work around a missing root.
- Assuming a modern browser represents every client.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.