3D PKI Trust Tree | mysimulator.uk

Trust Tree Shape

Intermediate CAs 3

Leaves per CA 3

Failure scenarios

Trusted leaves

–

Blast radius

–

Propagation time

–

Tree depth

3 ranks

How it works

A real PKI trust store isn't a single chain — it's a tree. One root CA (kept offline, rarely touched) delegates signing authority to several intermediate CAs, and each intermediate issues many leaf certificates. Trust doesn't crawl link-by-link the way a single TLS handshake does; the tree lets many independent chains share the same root, which is exactly why a root only needs to be trusted once for every certificate ever issued beneath it to be trustable.

trusted(leaf) = trusted(issuer(leaf)) ∧ ¬revoked(leaf) ∧ ¬expired(leaf)
trusted(root) = root ∈ trustStore
revoke(CA) ⇒ ∀ certs c issued (directly or transitively) by CA: trusted(c) = false

Intermediate CAs — width of the tree's middle rank; more intermediates mean any single compromise affects a smaller fraction of all certificates.
Leaves per CA — how many server certificates each intermediate has issued.
Revoke one intermediate CA — the defining PKI failure mode: the moment a CA's key is revoked, every certificate it ever signed is untrusted immediately and simultaneously — its entire branch, not just that one node. Watch the red wave consume the whole subtree at once.
Expire one leaf cert — by contrast, an expired leaf is a purely local failure: it doesn't touch its siblings or its issuing CA at all.

This blast-radius effect is why production CAs split issuance across many narrow intermediates instead of signing everything directly off the root: it bounds the damage of any one compromised key to a single branch of the tree.

Root CA (anchor) Trusted Revoked branch Expired leaf

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.