Root Program (Root store program)
Definition
A root program is a browser or operating-system vendor's policy and process for deciding which root CAs its trust store includes, constrains or removes.
A root program is the set of policies, reviews and enforcement actions a software vendor uses to manage its trust store. The major ones are run by Mozilla (whose list Firefox and many Linux distributions use), Google (the Chrome Root Program), Apple and Microsoft. CAs apply for inclusion, submit audits and disclosures through the CCADB, and must follow both the CA/Browser Forum Baseline Requirements and each program's own, often stricter, policy.
Why it matters
Root programs, not the CA/B Forum, decide whether a CA's certificates work. Chrome Root Program Policy v1.8 is a current example: from 2026-06-15 Chrome begins phasing out hierarchies not dedicated to TLS server authentication, new subordinate CAs disclosed from that date must assert only serverAuth, and subscriber certificates issued on or after 2027-03-15 must assert only the serverAuth EKU. Roots whose key material is more than 15 years old are removed on a schedule. When a CA fails expectations, programs can distrust it, as Chrome did with Entrust certificates whose earliest SCT is after 2024-11-11.
Example
The same certificate can be trusted by one client and not another. If a root is still in Mozilla's store but was removed from Chrome's, Firefox loads the site while Chrome shows NET::ERR_CERT_AUTHORITY_INVALID. Debian and Ubuntu build their ca-certificates package from Mozilla's list, so curl on those systems follows Mozilla's decisions.
Common misconceptions
- There is one global list of trusted CAs. Each vendor keeps its own, and the lists differ.
- Chrome always uses the operating system's roots. Chrome now ships its own Chrome Root Store on most platforms.
- Inclusion is permanent. Programs regularly remove roots because of key age, policy changes or incidents.