public key infrastructure hierarchy A hierarchy in which the roles of the certification authority are separated into one root CA and one or more subordinate CAs