Trusted Root Certificate Authority (CA)

A trusted root certificate authority (CA) is a third-party organization that issues digital certificates to verify the identity of individuals, organizations, and computer systems. The trusted root CA acts as a trusted third party and is responsible for verifying the identity of the certificate holder (Web server, typically), and issuing a digital certificate that binds the identity of the certificate holder to a public key.

Digital certificates

Digital certificates can be used to establish secure connections and authenticate the identity of the certificate holder (Server), such as a website, device, or individual. The Trusted root CA's certificate is pre-installed in most of the operating systems, browsers and devices, so that the users can trust the certificate issued by the trusted root CA as it is from a trusted source.

Trusted Root Folder

Advantages to having multiple CAs in the trusted root folder of a PC:

1. Flexibility: Having multiple CAs allows a PC to establish secure connections with a variety of different servers and services, which can be useful for connecting to different websites, applications, and networks.
2. Redundancy and failover: Having multiple CAs in the trusted root folder can provide redundancy in case one of the CAs is compromised or becomes unavailable. This can help to ensure that the PC can continue to establish secure connections even in the event of a failure.
3. Increased security: Having multiple CAs can help to increase the overall security of a PC's trust infrastructure by reducing the potential attack surface and providing increased flexibility in terms of policy and trust management.
4. Support for legacy systems: Some CAs may be added to the trusted root folder by the user or by an administrator in order to enable specific functionality or to support legacy systems.
5. Vendor independence: Different CAs are maintained and updated by different vendors and organizations, so it is possible that some CAs will be replaced or updated over time. Having multiple CAs in the trusted root folder allows a PC to continue to trust new or updated certificates even if one of the CAs is no longer in use.

Overall, having multiple CAs in the trusted root folder of a PC can help to ensure that the PC can establish secure connections with a variety of different servers and services, and can help to provide flexibility, reliability, and security in the event that one of the CAs is compromised or becomes unavailable.

Single Root CA

There are several disadvantages of supporting only one root certificate authority (CA)("one-tier hierarchy") for your organization:

1. Single point of failure: If the one root CA that you are relying on experiences an outage or is compromised, it can leave your organization's systems and networks vulnerable to attack.
2. Limited trust options: By only supporting one root CA, you are limiting the set of trusted parties that your organization can communicate with, which can be a disadvantage in certain situations.
3. Lack of diversity: Relying on a single root CA means that your organization is not diversifying its trust, which can increase the risk of a security breach.
4. Limited scalability: If your organization is growing and needs to communicate with more parties, you may not be able to scale up your trust infrastructure as easily if you are only supporting one root CA.
5. Dependence on a single entity: Relying on one single entity for trust can be risky as the trust model is dependent on the entity's security and reliability.

In general, it is recommended to have multiple root CA to ensure the security and reliability of your organization's trust infrastructure.

Examples of CA's being compromised before 2021

1. In 2011, the DigiNotar certificate authority (CA) was compromised, resulting in the issuance of rogue digital certificates for several high-profile domains. This incident highlighted the importance of diversity in the trust infrastructure, as relying on a single CA left the organization vulnerable to attack.
2. 2011-2012, the Comodo certificate authority (CA) was targeted by a phishing attack which resulted in the issuance of rogue digital certificates for several high-profile domains. This incident, similar to the DigiNotar incident, showed the importance of diversity in the trust infrastructure, as relying on a single CA left the organization vulnerable to attack.

Multiple Root CA

Supporting multiple root certificate authorities (CAs) can have several advantages, including:

1. Increased security: By using multiple CAs, the risk of a single point of failure is reduced. If one CA is compromised or experiences a technical issue, the other CAs can still provide valid certificates.
2. Improved trust: By supporting multiple CAs, the trustworthiness of digital certificates can be established from multiple sources, which can increase user confidence in the security of the system.
3. Improved scalability: By supporting multiple CAs, the system can handle a larger number of certificate requests and can be more easily scaled to meet the needs of a growing organization.
4. Increased flexibility: By supporting multiple CAs, organizations can choose the best CA for their specific needs and can change CAs if necessary.
5. Better compliance: By supporting multiple CAs, organizations can comply with industry-specific regulations and standards that may require the use of specific CAs.
6. Increased interoperability: By supporting multiple CAs, the system can work with a wider range of devices and systems, which can improve interoperability and reduce the need for additional configurations.
7. Cost effective solution: By having multiple root CA's can help organizations to save money by avoiding vendor lock-in, giving them the option to shop around and find the best deal.

Distribution/installation of root CA certificates

Root certificates are typically distributed through a variety of methods, including:

1. Operating System or Browser Distribution: Many operating systems and web browsers come pre-installed with a set of root certificates from trusted certificate authorities. These root certificates are automatically updated as part of regular software updates.
2. Manually Installed: Some organizations may choose to manually install root certificates on their systems and devices. This is often done for custom or internal certificate authorities that are not included in the default set of trusted root certificates.
3. Active Directory: Some organizations may use Active Directory to distribute root certificates to their systems and devices. This allows for central management of the root certificates and can make it easier to ensure that all systems and devices have the correct set of root certificates installed.
4. Public Websites: Some certificate authorities make their root certificates available for download on their public websites. These root certificates can be manually downloaded and installed on systems and devices.
5. Network Devices: In some cases, root certificates may be distributed through network devices such as routers, firewalls, or VPN gateways. This can be done through firmware updates or by manually configuring the device to trust the appropriate root certificates.

Overall, the distribution method will depend on the organization's security policies and infrastructure. The goal is to ensure that all systems and devices have access to the correct set of root certificates in order to establish trust for secure communication.