31Who decides which root CAs your devices trust? Explain root programs, trust stores per runtime, distrust events and root expiry.▼hardNewGoogleAppleMicrosoft◆ premiumThere is no single list of trusted roots. Browsers, operating systems, language runtimes and container images each carry their own, updated on their own schedules, and production outages follow from the differences.Open full answer →
38Why do CAs sign with intermediates instead of the root? Explain path building, cross-signing, name constraints and compromise.▼mediumNewGoogleMicrosoftApple◆ premiumThe root key is the one thing you can never easily replace, so it signs almost nothing. Everything about intermediates follows from that.Open full answer →