The self-signed anchor of a PKI hierarchy. Trust in every certificate below it flows from the root's presence in a trust store, so its private key is the most sensitive asset in the PKI and is usually kept offline. Roots sign intermediate CAs rather than end-entity certificates directly, so the root key is needed only rarely.
Root CA
Root Certificate Authority