9

I have found that my home PC (Windows 10) currently has 39 root certificates installed.

While scrolling though the list I have noticed:

  1. Names that look familiar (e.g. Thawte / VeriSign)
  2. Names that are unfamiliar to me (e.g. Startcom / Entrust)
  3. Expiry dates in the future (e.g. 2020-12-31 / 2030-01-01)
  4. Expiry dates in the past (e.g. 1999-12-31 / 2004-01-08)

All of this a a bit concerning and I would like to do more to control the situation. To start with I would like to confirm their legitimacy.

How can I verify that a root certificate is authentic?

Improve this question
2
  • What you see 'currently' is not a good guide; I don't know about 10 for certain, but I'd expect it to follow 7 and 8/8.1 which switched to a dynamic scheme where new certs can be added automatically and existing certs may be made untrusted, see technet.microsoft.com/en-us/library/cc751157.aspx
    – dave_thompson_085
    Commented Nov 11, 2015 at 20:02
  • 3
    Expired root certificates are used to verify signatures of certificates issued in the past.
    – sebix
    Commented Nov 11, 2015 at 20:13

2 Answers 2

Reset to default
3

This is often normal due to how operating systems publish root certificates. You're likely seeing the overlap between one CA's root certificate as it expires and is "covered" by a new certificate by the same CA. Nonetheless, good for you for not trusting blindly.

Most public Certificate Authorities publish fingerprint information about their root certificates. You can hunt these down from CA to CA and verify the certificate you see in your root trust store matches the fingerprints they publish. For example, Thawte publishes to https://www.thawte.com/roots/.

Each CA will have a different policy how they publish this information, but it should be easy to locate and verify with your own eyes.

Improve this answer
1
  • Note you need to check you have the authentic root AND the CA is sufficiently assuring the certs it issues under that root are authorized and accurate. The browser and OS vendors do this by requiring an audit of the CA, but if you don't trust Microsoft why should you trust Ernst&Young? Plan on spending several months at each CA examining their systems, policies, and people; you'll probably need to put up sizable bonds to protect their proprietary and confidential information.
    – dave_thompson_085
    Commented Nov 11, 2015 at 20:04
5

How can I verify that a root certificate is authentic?

Authenticity can be kind of checked if you search for the fingerprint online and find the certificate where you would expect it. But this is not foolproof because this might be a fake site which is just looking good and has a trustable host name. In any case you don't know the party personally and authenticity does not mean that the party can be trusted.

At the end you have to trust the vendor of your OS or browser that it is doing the right thing, because effectively you have no way to really verify it. But this kind of trust is not uncommon, i.e. you trust your supermarket that the food is edible and not expired or even poisoned, you trust your gas station that the gasoline is not dangerous for your car ... - i.e. you already trust others in security issues. And you hope that if this trust is no longer justified you will somehow be notified.

Trust can go wrong as can be seen in the Superfish affair where one trusted the vendor (Lenovo) to ship a trustable computer. But this computer contained a software to injects ads and additionally the software installed its own root certificate to man-in-the-middle connections in order to inject ads into https traffic too. This certificate was definitely authentic, but most people would not consider it trustable.

Improve this answer
4
  • In fairness, no one has to trust an OS vendor. Yes, your point about a CA's site being faked is legitimate and plausible. But if a end-user is willing to do the legwork to validate the CA certificate fingerprint, there are plenty of other ways to build that trust: Phone call, visit the office in person, etc. It's just that most won't go to those lengths.
    – Jeff Stice-Hall
    Commented Nov 11, 2015 at 15:58
  • @JeffStice-Hall: While there are probably (hard) ways to better find out if the CA is real and trustable I don't think phone call is a way, because you cannot really verify who is at the end of the phone. And even an office can be faked, although this is more costly then just a fake website. And perfect trust is simply not possible, so one has to decide when to stop checking and start believing that everything is fine. But yes, no one has to trust but if you don't trust anybody live usually gets even harder.
    – Steffen Ullrich
    Commented Nov 11, 2015 at 16:17
  • Agreed. My point is simply to suggest there are alternative ways to build trust than simply accepting what the OS/vendor does. If someone has invested the effort to successfully fake all of those verification paths and keep "you" from ascertaining the true identity of a CA, "you" have far greater issues than just a shady root certificate :)
    – Jeff Stice-Hall
    Commented Nov 11, 2015 at 16:21
  • @JeffStice-Hall if someone goes to trouble of setting up a fake CA, they probably aren't trying to fool you or the OP specifically, they're trying to fool everybody -- or at least the Internet, which is a big fraction of people. That's a much more valuable, and therefore sensible, goal. Think Enron, not "The Sting".
    – dave_thompson_085
    Commented Nov 11, 2015 at 19:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .