The certificates trusted model and trusted root certificates management of current PKI system were analysed. A leak in the trusted root certificates management was pointed out. Further

the wrong trusting and information leak caused by certificates replacement were analyzed. Finally

the trusted root certificates management tree based on binary signature tree was presented

and the forming of trusted root certificates management tree and the algorithm of trusted root certificates verification were given. Thus

the trusted root certificates management tree not only keeps the trusted root certificates from being replaced

but also have little size and light computing.