Clients must trust the servers they connect to in order to prevent sending sensitive information, like passwords or other confidential data, to unauthorized parties. They need to verify the server's identity.
Servers prove their identity using digital certificates issued by Certificate Authorities (CAs). These certificates contain information about the server, such as the hostname and the server's public key, and are cryptographically signed by the issuing CA.
Clients can validate the integrity of a server’s certificate and its signature using cryptographic methods. To do this, clients need to recognize and trust the issuing certificate authority. Therefore, clients maintain trust stores that contain information about trusted, well-known certificate authorities.
In practice, there are usually two certificate authorities involved in building a chain: The CA that issues the server certificate is called the intermediate CA and can prove its identity with a certificate issued by a root CA. Root CAs are at the start of the chain and do not have another CA that can issue their certificates. A root CA’s certificate is self-signed. That’s why clients need to keep these certificates in their trust list: because there is no higher CA to prove their identity.
Example: Browsers
Web browsers come with built-in trust stores or utilize the trust stores provided by the operating system to verify server certificates. Without this trust store, browsing the internet would be more difficult, and you would need to maintain the trust store yourself.
SAP systems also leverage trust stores; however, the number of trusted certificate authorities that the system trusts out of the box depends on the system.
