From what I understand, the certificate authorities (CAs) have to get their root certificate included in the browser.
What if the root certificate of a particular CA is not included in the web browser yet. Is there another way to get it in? Maybe my question is not clear enough. The question shoud be : in a PKI hierarchical model, if subCAs have not root certificate include in web browser then how subCAs can get in?
Depends on the browser and the host OS, but it is usually possible to tell the OS or browser to trust a new CA.
For example, if you are using Internet Explorer or Chrome on Windows then you can import a certificate into the Windows "trusted root CA" certificate store and it will be trusted unless another certificate is pinned. Firefox is more complicated.
As another example, you can install a new certificate on Android. This should work for most or all browsers, but they might ask you to make an exception before trusting your new certificate.
Other operating systems and browsers have different mechanisms for certificate installation.
