There are provided measures for trust anchor update in a public key infrastructure. Such measures exemplarily comprise, for managing, in a network utilizing authentication based on certificates for secure connections between end entities, an update from an old trusted anchor certificate to a new trusted anchor certificate, wherein each of said trusted anchor certificates is a root point of a chain of certificates, providing, for a pre-migration period, said old trusted anchor certificate as valid, providing, for a migration period, said old trusted anchor certificate and said new trusted anchor certificate, coincidentally, as valid, and providing, for a post-migration period, said new trusted anchor certificate as valid.