An R2R certificate is not a cross-signature, nor a subordinate CA, nor a bridge. It is a cryptographic handshake between two ultimate authorities—a treaty signed at the summit of two distinct mountains of trust. In practical terms, it occurs when Root CA A issues a certificate directly to Root CA B , making B a subordinate of A in one direction, while B simultaneously (or previously) considers itself a peer. The result is a cyclic dependency of absolute power. To understand the R2R, we must first recall the root’s defining feature: self-signature . A root certifies itself. Its validity is an axiom, not a proof. When you install a root certificate, you are performing an act of faith, encoded in a hash.

Thus, the R2R certificate is a masterpiece of engineering irony: a structure designed to be invisible, operating only in the shadow of the root’s self-signed solitude. It is the cryptographic equivalent of two mirrors facing each other — infinite regression masked as redundancy.

Another domain: . When Microsoft’s root expires, they issue an R2R from the old root to the new root. Windows XP, long dead, will still trust the new root because it trusts the old one. The R2R becomes a necromantic ritual, binding the dead to the living. Philosophical Aftermath: Is Trust Still Transitive? The R2R asks a quiet, devastating question: What happens when two ultimate authorities agree? In human governance, two kings signing a treaty do not merge their thrones. In cryptography, two roots signing each other’s certificates almost merge their trust domains — but not quite. Because trust is ultimately client-side. The R2R only works if the client has either root installed. If the client has both, the cycle is visible. If the client has neither, the R2R is a beautiful, useless signature on a ghost.

In the end, the R2R reminds us that trust, even at the root, is not a fact. It is a narrative. And sometimes, the best way to change a story is to have the old narrator introduce the new one, shake hands, and quietly disappear into the hash.

Consider validation: A path-building algorithm, when faced with an R2R, must be careful not to loop forever. Standard X.509 path validation (RFC 5280) expects a monotonic chain toward a single trust anchor. R2R violates that assumption. Implementations must introduce or explicit policy mappings to cut the cycle. Without them, the validator could theoretically walk from Root A to Root B and back to Root A, ad infinitum.

More troubling is the . If two roots cross-certify each other directly, an attacker compromising one root can now impersonate the other. Because the compromised root can issue a certificate that chains to the honest root (via the R2R), the honest root’s name and key material are now effectively co-signed by the adversary. The two roots’ security postures merge. Trust becomes the weakest link multiplied. The R2R in the Wild: Case Study of an Ageing Internet The most famous example is the VeriSign Class 1 – Thawte Roots cross-certification from the early 2000s, though those were typically CA-to-CA, not pure root-to-root. A purer example exists in the Federal Bridge Certificate Authority (U.S. government), where multiple agency roots cross-certify with the Bridge, creating a mesh. At the extreme, two agency roots could directly cross-certify — a true R2R.

An R2R violates this solitude. It says: “I, Root A, vouch for Root B’s existence and legitimacy.” And Root B, in turn, may vouch for Root A. The loop closes. Now, a client that trusts only Root A will accept any certificate signed by Root B, because the chain of trust resolves: Leaf → B (signed by A) → A (self-signed). Conversely, a client trusting only Root B sees a different path: Leaf → A (signed by B) → B (self-signed).