Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is a Trust Anchor?
Short answer
A trust anchor is the directly trusted CA certificate on which certificate validation relies; chain validation always ends by reaching a trust anchor (RFC 5280). It is usually a root CA, but a system can also define just a specific intermediate CA as its trust anchor. In TR7, CA records added without a private key appear in the Certificate Authorities (CA) list with the Trust Anchor kind; they are added with Add a trusted CA certificate, do not sign certificates and are used only for building chains and for certificate validation.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| Certificates & PKI → Certificate Authorities (CA) → Add | Operation = Add a trusted CA certificate, CA Certificate (PEM) | Adding the trusted CA certificate |
| Certificate Authorities (CA) list | Kind = Trust Anchor | A record without a private key, used only in validation; the parent CAs in the chain pasted while Enroll under an external CA is being completed are also added with this kind |
| Certificates & PKI → TLS Security Profiles | CA Certificate Files | The trust anchors on which client certificates rely in mTLS |
| Backend Service | Verification CA Profile | The trust anchor on which the Backend Service certificate relies |
| SSL/TLS Certificates → Manual or PFX | Intermediate Cert. Content, Root Cert. Content = Use Profiles | Building the certificate's chain from the CA record |
Common Misconceptions
- "A trust anchor can issue certificates." Because it has no private key, it cannot sign; in TR7, issuing certificates requires an internal CA that has a key (Create Root CA, Create Issuing CA, Import Existing CA).
- "A trust anchor is necessarily a root CA." It is usually a root; any CA certificate on which validation relies can be defined as a trust anchor. For example, the self-signed certificate of the Backend Service can be selected as the Verification CA Profile.
- "Adding a trust anchor makes it trusted in all validations." In TR7, a CA record is used only where it is selected (mTLS profile, Backend Service, health check, chain).
How it is done in the documentation
