Every CA also has a certificate to confirm its own identity, issued by another trusted CA or, in the case of root CAs, issued by itself.

Enterprise An internal, private PKI root CA that has been deployed with Active Directory.

GroupPolicy An internal, private PKI root CA that has been deployed with Group Policy.

Registry An internal, private PKI root CA that has been manually installed in the certificate store.

The Root ESCB-PKI certification authority

Create your own root CA on Windows Server 2012 to sign your certificates yourself.

Therefore, both the physical security and the certificate issuance policy of a root CA are normally more rigorous than those for subordinate CAs.

generate the private key and the certificate of the Certificate Authority if it is a Root CA or import it if it is an intermediate CA;

This listing continues until the last certificate in the list is for a root CA.

Otherwise, you will have a trusted root CA that automatically issues certificates without verifying the identity of the certificate requester.

If you want to trust a certificate that has been issued by a private root CA, you can manually add that root certificate to the Trusted Root certificate store on a computer that is running Windows.

A self-signed certificate is easy to create but is not as trustworthy as a certificate granted by a root certificate authority.

If you sign your AIR application, you can either use a digital certificate granted by a root certificate authority or create a self-signed certificate.

If a server certificate is signed by a CA with a self-signed certificate, the certificate chain is composed of exactly two certificates: the end entity certificate and the root CA.

In such a system, a root CA or other computing device avoids having to generate an explicit self-signed certificate by instead generating a self-signed implicit certificate.