Infrastructure & Operations
What Is Trust Store (Root Store)?
A trust store (root store) is the curated set of root CA certificates a system considers trustworthy — the anchors every chain validation ends at. Operating systems, browsers and language runtimes each maintain their own, which is why one certificate can be trusted in Chrome, rejected by Java and unknown to curl at the same time.
Where trust stores live
Windows has the system Certificate Store (managed via Group Policy or Intune); macOS the Keychain; most Linux distributions /etc/ssl/certs built by ca-certificates; Firefox and Java ship their own (NSS database, cacerts). Mobile platforms and Docker base images each carry theirs too. Any internal root must be distributed to every store your clients actually use — missing one is the classic "trusted on the laptop, untrusted in the container" surprise.
Who decides what is in the public stores
The major root programs — Mozilla, Microsoft, Apple, Google — admit CAs after audits and public review, enforce the CA/Browser Forum Baseline Requirements, and remove CAs that fail (Symantec 2018 being the famous case). The programs move independently, so distrust events roll out unevenly across platforms.
Managing your own trust
For enterprises the rules are: distribute internal roots centrally (GPO/MDM/config management), never ask users to install certificates manually, audit periodically for stale or rogue additions — an unauthorized root in the store means every TLS session can be silently intercepted — and remember application-specific stores (Java, Python, Node) in the rollout.
Try it yourself — free tools
- Certificate Checker — inspect a root or intermediate before adding it to a trust store
- Certificate Converter — convert roots into the format each platform expects
How MI Support IT can help
PKI Tools is built by MI Support IT, a Danish IT company with deep specialization in enterprise PKI: ADCS design and health checks, Venafi certificate automation, key ceremonies and CP/CPS documentation. Read about our PKI services or get in touch.
PKI Glossary
- Certificate Chain (Intermediate Certificates)How leaf, intermediate and root certificates link together — and why a missing intermediate breaks TLS.
- Certificate Authority (CA)The trusted organization that issues and signs digital certificates — and the root of every trust chain.
- Self-Signed CertificateA certificate signed by its own key — useful for labs and roots, dangerous as a habit in production.
- Browse all terms →