Notifications
Clear all
Topic starter
12/07/2026 12:20 pm
TL;DR: Root ubiquity determines whether certificates are trusted across browsers, devices, and platforms, while cross-signing helps new certificate authorities build trust without breaking existing validation paths, according to GlobalSign. For identity and security teams, the issue is less about certificate theory than about interoperability, trust continuity, and avoiding failures that can interrupt transactions and compliance.
NHIMG editorial — based on content published by GlobalSign: root ubiquity, trust chains, and cross-signing in PKI
Questions worth separating out
Q: How should organisations choose a certificate authority for broad interoperability?
A: Choose a certificate authority based on root ubiquity, validation reliability, and the trust stores used by the systems you actually operate.
Q: Why do cross-signed certificates matter during CA transitions?
A: Cross-signing matters because it lets a new or transitioning root inherit trust through an already trusted certificate chain.
Q: What breaks when a certificate root is not widely trusted?
A: When a root is not widely trusted, certificate validation can fail across browsers, devices, and applications even if the certificate itself is intact.
Practitioner guidance
- Verify trust-store coverage before rollout Check whether the issuing root is present in the browsers, operating systems, devices, and partner environments that must validate the certificate chain.
- Map certificate chains used in production Document the full chain from leaf certificate to intermediate to root, including any cross-signed paths.
- Treat CA transitions as change-managed identity events Plan migrations with explicit validation testing, fallback paths, and communication to platform owners.
What's in the full article
GlobalSign's full article covers the operational detail this post intentionally leaves for the source:
- How root ubiquity is evaluated across browsers, devices, and platforms in practice
- Why cross-signing is used during certificate authority transitions and interoperability changes
- How certificate chain trust affects customer-facing HTTPS and partner integrations
- What organisations should consider when selecting a CA for broad trust coverage
👉 Read GlobalSign's explanation of root ubiquity and cross-signing →
Root ubiquity and certificate trust: what IAM teams should know?
Explore further
12/07/2026 12:34 pm
Root ubiquity is a trust-distribution problem, not a certificate-format problem. A certificate can be technically valid and still fail if the relying party does not trust the issuing root. That means PKI success depends on ecosystem coverage across browsers, devices, and platforms, not only on cryptographic correctness. Practitioners should treat trust-store presence as a governance dependency, not an afterthought.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to The State of Secrets in AppSec.
A question worth separating out:
Q: Who is accountable for certificate trust and root distribution?
A: Accountability should sit with the teams that own identity infrastructure, security governance, and platform reliability together, because certificate trust affects all three. The right control model covers certificate issuance, trust-store assumptions, renewal, transition planning, and exception handling. If those duties are scattered, root trust problems become invisible until services fail.
👉 Read our full editorial: Root ubiquity and cross-signing shape certificate trust on the web
