An organizational structure that attempts to guarantee the validity of certificates. The usual configuration is hierarchical: certificates from a particular certificate authority will themselves by validated by certificates from a higher-level authority. At the top of the hierarchy is an unsigned or self-signed root certificate; for public use this will be from a specialist reputable CA that is globally trusted. The alternative decentralized web of trust model relies on self-signed certificates accumulating endorsements from other parties, one or more of which a new user will be prepared to accept as trustworthy.