8.1 Trust Distribution

A certificate from a private CA is only accepted by clients that trust its root. Distributing the root certificate to your devices is the one piece of private PKI that public PKI never asks of you — and CertKit automates the most common case.

Automatic installation via agents

Any agent that deploys a certificate from one of your private CAs automatically receives that CA’s root certificate and ensures it is present in the host’s trust store:

Platform	Trust store	Mechanism
Windows	Local Machine Trusted Root Certification Authorities	Certificate store import
Debian / Ubuntu	/usr/local/share/ca-certificates	update-ca-certificates
RHEL / Fedora / Amazon Linux	/etc/pki/ca-trust/source/anchors	update-ca-trust extract

Installation is enabled per CA with the Auto-install root on agents toggle. With the toggle off, agents still check and report trust status but never modify the host.

Trust status

Each CA’s details page shows a per-host trust matrix reported by your agents:

Status	Meaning
TRUSTED	The root is present in the host trust store.
INSTALLED	The agent installed the root on its most recent check. Subsequent checks report TRUSTED.
NOT_TRUSTED	The root is missing and auto-install is disabled.
ERROR_INSTALL	Installation was attempted and failed. The agent retries on its next cycle; the status message contains the error.
UNSUPPORTED_OS	The agent cannot manage the trust store on this platform.

Manual distribution

For hosts without an agent, download the root certificate from the CA’s details page or from its stable public URL, then distribute it with your existing tooling:

• Windows fleets — Group Policy: Computer Configuration → Policies → Windows Settings → Security Settings → Public Key Policies → Trusted Root Certification Authorities.
• macOS / iOS / Android — your MDM’s certificate payload.
• Linux fleets — configuration management (Ansible, Puppet, Salt) writing the anchor file and running the platform’s update command shown above.

The public root URL is anonymous by design. Root certificates are public material — trust comes from installing them, not from keeping them secret.

What the OS trust store does not cover

Some software maintains its own trust store and ignores the operating system’s:

• Java applications read the JRE’s cacerts keystore. Import the root with keytool -importcert -cacerts -alias corp-root -file root.pem.
• Firefox uses its own NSS store. Deploy via Firefox enterprise policies (Certificates.Install) or enable security.enterprise_roots.enabled to have Firefox honor the OS store.
• Containers trust only what is in their image. Add the root to your base images; an agent on the container host does not affect containers.

Bring your own root

Trust distribution does not apply to Bring Your Own Root CAs. Certificates chain to a root your devices already trust, so CertKit neither distributes nor publishes it.