# What Is Root Program (Root store program)? Definition and Examples

> A root program is a browser or operating-system vendor's policy and process for deciding which root CAs its trust store includes, constrains or removes.

Source: https://ssl.sh/glossary/root-program/
Last updated: 2026-11-10

A root program is the set of policies, reviews and enforcement actions a software vendor uses to manage its [trust store](https://ssl.sh/glossary/trust-store/). The major ones are run by Mozilla (whose list Firefox and many Linux distributions use), Google (the Chrome Root Program), Apple and Microsoft. CAs apply for inclusion, submit audits and disclosures through the [CCADB](https://ssl.sh/glossary/ccadb/), and must follow both the CA/Browser Forum Baseline Requirements and each program's own, often stricter, policy.

## Why it matters
Root programs, not the CA/B Forum, decide whether a CA's certificates work. Chrome Root Program Policy v1.8 is a current example: from 2026-06-15 Chrome begins phasing out hierarchies not dedicated to TLS server authentication, new subordinate CAs disclosed from that date must assert only serverAuth, and subscriber certificates issued on or after 2027-03-15 must assert only the serverAuth EKU. Roots whose key material is more than 15 years old are removed on a schedule. When a CA fails expectations, programs can [distrust](https://ssl.sh/glossary/distrust/) it, as Chrome did with Entrust certificates whose earliest SCT is after 2024-11-11.

## Example
The same certificate can be trusted by one client and not another. If a root is still in Mozilla's store but was removed from Chrome's, Firefox loads the site while Chrome shows NET::ERR_CERT_AUTHORITY_INVALID. Debian and Ubuntu build their ca-certificates package from Mozilla's list, so curl on those systems follows Mozilla's decisions.

## Common misconceptions
- **There is one global list of trusted CAs.** Each vendor keeps its own, and the lists differ.
- **Chrome always uses the operating system's roots.** Chrome now ships its own Chrome Root Store on most platforms.
- **Inclusion is permanent.** Programs regularly remove roots because of key age, policy changes or incidents.

## Related terms

- [信任库](https://ssl.sh/zh/glossary/trust-store/): 信任库是操作系统、浏览器或编程语言运行时内置的一组根 CA 证书，验证证书链时以它们作为信任锚。
- [根证书](https://ssl.sh/zh/glossary/root-certificate/): 根证书是位于证书链顶端、由 CA 自签名的证书，预装在操作系统或浏览器的信任库中，作为验证其他证书的信任锚。
- [证书颁发机构](https://ssl.sh/zh/glossary/certificate-authority/): 证书颁发机构（CA）是负责审核申请者、签发数字证书，并把公钥与域名或身份绑定在一起的机构。
- [CA/B 论坛](https://ssl.sh/zh/glossary/ca-browser-forum/): CA/B 论坛是证书颁发机构与浏览器厂商组成的自愿性行业组织，负责制定公开信任证书必须遵守的基线规则。
- [CCADB](https://ssl.sh/zh/glossary/ccadb/): CCADB 是通用 CA 数据库，CA 在这里向各根证书计划披露其根证书、中间证书、审计报告、政策文件和 CRL 地址。
- [取消信任](https://ssl.sh/zh/glossary/distrust/): 取消信任是根证书计划作出的决定：不再信任某家 CA 的证书，可能是全部证书，也可能只针对截止日期之后签发的证书。
- [WebTrust 审计](https://ssl.sh/zh/glossary/webtrust/): WebTrust 审计是由持证审计师依据 CA/B 论坛和根证书计划要求检查 CA 内部控制的审计框架，全称 WebTrust for CAs。