---
type: concept
title: CA Trust Anchoring
tags: [pki, security, trust-model]
related: [unihgw-ca, dfn-pki-zertifikate]
created: 2026-06-30
updated: 2026-06-30
sources: ["output/rz_uni_greifswald_de_dienste_allgemein_dfn_pki_zertifikate_unihgw_ca.md"]
---

# CA Trust Anchoring

**CA Trust Anchoring** refers to the process by which a root certificate from a Certificate Authority (CA) is pre-installed in the "trust store" of an operating system, web browser, or email client.

## Global vs. Internal Trust
- **Globally Anchored CAs**: Public CAs (like those used in [[dfn-pki-zertifikate]]) are pre-installed in most software. When a user visits a site signed by a globally anchored CA, the browser recognizes the root and trusts the connection automatically.
- **Internal CAs**: An internal CA, such as [[unihgw-ca]], is not pre-installed in global software. Therefore, any certificate issued by an internal CA will be flagged as "untrusted" by default unless the specific root certificate is manually imported into the client's trust store.

## Implications for Deployment
Because internal CAs are not anchored globally, they are unsuitable for public-facing services where the university cannot control the client's trust store (e.g., general web visitors or external email recipients).