Root Program

When you visit a website, your browser checks in the background whether the connection is trustworthy. This check is based on digital certificates — small files that confirm: “This website really is what it claims to be.” Such certificates are issued by organizations called certificate authorities. For a browser to trust a certificate authority at all, it must appear on a specific list: the root program. The root program is thus a kind of approval list that decides which certificate authorities are recognized as trustworthy — and thereby, indirectly, which websites are considered secure.

The Foundation of Secure Web Connections

Without root programs, trust on the internet would hardly be organizable. There are hundreds of certificate authorities worldwide. No individual user can personally verify which of them operate reputably. Root programs take on precisely this task on behalf of everyone.

The best-known root programs are operated by Microsoft (for Windows), Apple (for macOS and iOS), Mozilla (for Firefox), and Google (for Chrome and Android). Each program maintains its own so-called root store — the specific file or database containing the recognized certificate authorities. An authority that gets dropped from even a single one of these programs immediately loses the trust of millions of devices.

This makes root programs one of the most powerful levers in internet security. In 2016, Google threatened to remove the Chinese certificate authority CNNIC from its root store after it had tolerated fraudulent certificates. The mere announcement was enough to discipline the authority in question.

Admission, Review, and Exclusion

Anyone wishing to be admitted to a root program as a certificate authority goes through an application process lasting months. The program’s operators examine technical security standards, independent audits, and the applicant’s internal policies. Mozilla publishes this process fully in public — including all discussions and decisions.

Admitted authorities must regularly demonstrate that they continue to meet the requirements. Violations are penalized in stages: from a public warning, through restrictions on the types of certificates that may be issued, up to complete exclusion. An exclusion does not take effect immediately for all existing certificates — operators usually set transition periods so that websites have time to replace their certificates.

A common misconception: many believe that the padlock icon in the browser means a website is substantively safe or reputable. In fact, it only shows that the connection is encrypted and that the certificate comes from a recognized authority. Even a fraudulent site can hold a valid certificate — root programs verify the identity of an organization, not its intentions.

Root Programs in the News and in Products

Root programs usually appear in tech news when something goes wrong. In 2023, the Turkish certificate authority E-Tugra made headlines after Google and Mozilla identified security shortcomings and threatened exclusion. Such reports sound technical, but have direct consequences: operators of websites with certificates from that authority must react quickly, or a warning page will appear to their visitors.

Root programs also become politically relevant. Governments have occasionally tried to get their own state certificate authorities included in root programs. Kazakhstan attempted this in 2019 in order to be able to monitor its own internet traffic. Mozilla and Google refused. This shows that root programs are not merely a technical instrument but also a political one — whoever controls the list has considerable influence over how open or surveilled the internet is in a given country.

For developers, root programs are relevant in everyday work. Anyone setting up a new application or a corporate device can mark their own certificates as trustworthy — but only locally, for their own system. On the public internet, there is no way around the major root programs.