A Certification Authority that is directly trusted by an End–entity; that is, securely acquiring the value of a Root CA public key requires some out-of-band step(s). This term is not meant to imply that a Root CA is necessarily at the top of any hierarchy, simply that the CA in question is trusted directly.

The certificate authority (CA) with a self-signed certificate at the top of a certificate chain. See also CA certificate, subordinate CA.

A top level CA. A root CA has a self-signed certificate that contains its own public key. The router obtains this certificate via a user interface command, thereby enabling the root CA to sign other certificates.