High Quality Content by WIKIPEDIA articles! In a Public Key Infrastructure PKI the top of the trust path is the Certificate authority (CA), because is on the top is called the root CA. The CA is able to issue, distribute and revoke digital certificates X.509. The CA which is software running in a specialized server or hardware in general must be kept safe with the highest possible physical and logical security measures, therefore one of the options is not keeping the CA connected to the network and keep it physically separated, therefore several options exist: