Certificates and the chain of trust

On its own, a public key is just a long number; it does not say who owns it. Someone could publish a fake key and claim it belongs to a university. CertificatesA digital document binding a public key to an institution, signed by a higher authority. The standard is X.509. close that gap.

What is a certificate?

A certificate is a small digital document saying "this public key belongs to this institution". It holds the institution's name, its public key, validity dates and the signature of the authority vouching for the link. The padlock on websites works with the same technology; the standard is called X.509.

The chain of trust

Who signs the certificate? A certificate higher up. That forms a chain, and at its top sits a root certificateThe trusted certificate at the top of the chain. In Tamga, each country's root is pinned in the trust list.. In Tamga Network the chain looks like this:

1. The list of trusted lists says which country lists exist and who signs them.
2. The country listholds that country's root certificate and its registered institutions.
3. The institution certificateis signed by the root and carries the institution's signing key.
4. The credential is signed with that key.

The verifier follows the chain upwards: if the credential's signature matches the institution certificate, the institution certificate matches the root, and the root matches the list entry, the chain is complete.

Who holds the root?

In Tamga Network each country's root sits in that country's list. Today Tamga operates the Türkiye root provisionally, on behalf of the state. When the state or the body it authorises publishes its own root and list, only the address and the signer change; credentials and wallets stay the same.